CVE-2019-5736: apache mesos
Modified
AliasesALPINE-CVE-2019-5736MGASA-2019-0068MGASA-2019-0087SUSE-SU-2019:0362-1SUSE-SU-2019:0385-1openSUSE-SU-2019:2286-1RHSA-2019:0303RHSA-2019:0304RHSA-2019:0408RHSA-2019:0975UBUNTU-CVE-2019-5736DEBIAN-CVE-2019-5736CGA-2wwv-p7x3-r95fCGA-77qf-qpfm-657jCGA-8cpg-v3jc-vc4mCGA-94x2-9jmf-98fcCGA-978p-7c3v-mv3wCGA-9hwc-8pcw-x5jhCGA-p55f-2wwv-f4wvCGA-pw2g-jxp6-gr33CGA-qcwp-j344-7rx5CGA-rm8q-vfmf-fv6xopenSUSE-SU-2019:2245-1
Published 11-02-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-5736 is a high (CVSS 9.3) vulnerability in apache mesos. EPSS estimates a 98.45% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.
Priority
Prioritiseweaponized exploit
Weaponized exploit (Metasploit, 01-01-2019)
Source freshness unavailable
How is this decided?CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
98.45%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits9github, reference, exploit-database, metasploit
Advisory lineage
Upstream 0 · Downstream 19 · Related 21OPENSUSE-SU-2019:0170-1OPENSUSE-SU-2019:1227-1OPENSUSE-SU-2019:1275-1OPENSUSE-SU-2019:1444-1OPENSUSE-SU-2019:1499-1OPENSUSE-SU-2019:1506-1OPENSUSE-SU-2019:2021-1OPENSUSE-SU-2024:10693-1OPENSUSE-SU-2024:10762-1OPENSUSE-SU-2024:11030-1OPENSUSE-SU-2024:11358-1SUSE-SU-2019:0495-1SUSE-SU-2019:0573-1SUSE-SU-2019:1234-1SUSE-SU-2019:1234-2SUSE-SU-2019:2117-1SUSE-SU-2019:2119-1SUSE-SU-2021:1458-1USN-4048-1CGA-358X-29H6-CWGVCGA-6F3P-HV3H-6GMW
Timeline
- 11-02-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS metrics
9 scores · 7 sources · 3 versionsHigh 8.6Preferred score · OSV · Alpine (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- NVDNIST8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
High 7.7Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HSources2 sources · 7.7–8.6
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
High 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
98.45%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 98.45% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
9 foundCve 2019 5736 Poc
Maturity: poc
Cve 2019 5736 Poc
Maturity: poc
Exploit Reference (brauner.github.io)
Maturity: unknown
Show all 9 exploits
Exploit Reference (blog.dragonsector.pl)
Maturity: unknown
Exploit Reference (support.mesosphere.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1)
Maturity: poc
runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)
Maturity: poc
Docker Container Escape Via runC Overwrite
exploit/linux/local/docker_runc_escape
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat44 products
- container_development_kit3.7
- enterprise_linux8.0
- enterprise_linux_server7.0
- openshift3.4 | 3.5 | 3.6 | 3.7
- buildah< 0:1.5-3.gite94b4f9.module+el8.0.0+2958+4e823551
Chainguard5 products
- py3-dockerAll versions (No fix recorded)
- py3.10-dockerAll versions (No fix recorded)
- py3.11-dockerAll versions (No fix recorded)
- py3.12-dockerAll versions (No fix recorded)
- py3.13-dockerAll versions (No fix recorded)
Wolfi5 products
- py3-dockerAll versions (No fix recorded)
- py3.10-dockerAll versions (No fix recorded)
- py3.11-dockerAll versions (No fix recorded)
- py3.12-dockerAll versions (No fix recorded)
- py3.13-dockerAll versions (No fix recorded)
Suse4 products
- docker-runc&distro=SUSE Linux Enterprise Module for Containers 12< 1.0.0rc5+gitr3562_69663f0bd4b6-1.9.1
- docker-runc&distro=SUSE Linux Enterprise Module for Containers 15< 1.0.0rc5+gitr3562_69663f0bd4b6-6.9.1
- docker-runc&distro=SUSE OpenStack Cloud 6-LTSS< 1.0.0rc5+gitr3562_69663f0bd4b6-1.9.1
- lxc&distro=SUSE Package Hub 15 SP1< 3.2.1-bp151.5.3.1
Alpine3 products
- flatpak< 1.0.7-r0
- lxc< 3.1.0-r1
- runc< 1.0.0_rc7-r0 | < 1.0.0_rc7 | < 1.0.0_rc6-r1
Opensuse3 products
- backports_sle15.0 | 15.0:sp1
- leapEOL15.0 | 15.1 | 42.3
- lxc&distro=openSUSE Leap 15.1< 3.2.1-lp151.4.5.1
D2iq2 products
- dc\/os< 1.10.10 | ≥ 1.10.11, < 1.11.9 | ≥ 1.11.10, < 1.12.1
- kubernetes_engine< 2.2.0-1.13.3
Debian2 products
- lxc< 1:3.1.0+really3.0.3-4
- runc< 1.0.0~rc6+dfsg1-2
Mageia2 products
- lxc< 2.0.8-1.1.mga6
- opencontainers-runc< 1.0.0rc5-3.2.mga6
Netapp2 products
Ubuntu2 products
- docker.io< 18.06.1-0ubuntu1.2~16.04.1 | < 18.06.1-0ubuntu1.2~18.04.1
- runc< 1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1 | < 1.0.0~rc4+dfsg1-6ubuntu0.18.04.1
Apache1 product
- mesos≥ 1.4.0, < 1.4.3 | ≥ 1.5.0, < 1.5.3 | ≥ 1.6.0, < 1.6.2 | ≥ 1.7.0, < 1.7.2
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 18.10 | 19.04
Docker1 product
- docker< 18.09.2
Fedoraproject1 product
- fedoraEOL29 | 30
Google1 product
Hp1 product
Linuxcontainers1 product
- lxc< 3.2.0
Linuxfoundation1 product
- runc≤ 0.1.1 | 1.0.0:rc1 | 1.0.0:rc2 | 1.0.0:rc3 | 1.0.0:rc4 | 1.0.0:rc5 | 1.0.0:rc6
Microfocus1 product
- service_management_automation2018.02 | 2018.05 | 2018.08 | 2018.11
20 vendors · 83 products
References
95 links- github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40dFIXPatchThird Party Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runcVendor AdvisoryAdvisoryThird Party Advisory
Show all 95 references
- github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558bFIXPatchThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_usREPORTPermissions Required
- brauner.github.io/2019/02/12/privileged-containers.htmlEVIDENCEExploitTechnical DescriptionThird Party Advisory
- www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/AdvisoryThird Party Advisory
- blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.htmlARTICLEEVIDENCEExploitMitigationThird Party Advisory
- support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003FIXExploitPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944AdvisoryThird Party Advisory
azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/FIXPatchThird Party AdvisoryVendor Advisory- azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/FIXPatchThird Party AdvisoryVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- packetstormsecurity.com/files/163339/Docker-Container-Escape.htmlEVIDENCEExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.htmlAdvisoryThird Party AdvisoryVDB Entry
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory