Unverified50% confidenceFactExact time
The runC vulnerability CVE-2019-5736 allows processes inside a container to overwrite the runC binary on the host machine.
1
Sources
50%
Confidence
Long-term
Relevance
9/8/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedDocker底层依赖containerd作为高级运行时，再由containerd调用runc完成容器创建64% similarUnverified容器运行时通常分为高级运行时（如containerd、CRI-O）和低级运行时（如runc）两层，低级运行时直接调用Linux内核的namespace和cgroup机制实现进程隔离和资源限制63% similarUnverifiedIn Kubernetes, kubelet calls the container runtime (such as containerd), which creates the container process via runc, potentially going through a pause container to maintain the Pod's network namespace.62% similarUnverified2015年曝光的VENOM漏洞（CVE-2015-3456）通过向QEMU模拟的虚拟软盘控制器发送特制I/O命令触发堆溢出，实现从Guest到Host的完整VM逃逸60% similarUnverifiedDocker容器方案通过Linux的cgroup和namespace机制实现资源隔离，可通过seccomp配置文件控制系统调用白名单，但冷启动延迟在百毫秒量级59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/878572API
curl https://kongchang.com/api/v1/knowledge/claims/878572MCP
get_claim(id=878572)