{"uuid": "9eeccbe0-3014-4f23-b83d-3b8c3ac7972e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0492", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64, cmd\", \"author\": [\"h00die\", \"Yiqi Sun\", \"Kevin Wang\", \"T1erno\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This exploit module takes advantage of a Docker image which has either the privileged flag, or SYS_ADMIN Linux capability.\\n          If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system.\\n\\n          A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.\\n          This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges\\n          and bypass the namespace isolation unexpectedly.\\n\\n          More simply put, cgroups v1 has a feature called release_agent that runs a program when a process in the cgroup terminates.\\n          If notify_on_release is enabled, the kernel runs the release_agent binary as root. By editing the release_agent file,\\n          an attacker can execute their own binary with elevated privileges, taking control of the system. However, the release_agent\\n          file is owned by root, so only a user with root access can modify it.\", \"disclosure_date\": \"2022-02-04\", \"fullname\": \"exploit/linux/local/docker_cgroup_escape\", \"is_install_path\": true, \"mod_time\": \"2026-05-25 09:47:44 +0000\", \"name\": \"Docker cgroups Container Escape\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/docker_cgroup_escape.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/docker_cgroup_escape\", \"references\": [\"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af\", \"URL-https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/\", \"URL-https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC\", \"URL-https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492\", \"URL-https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker/blob/main/escape-check.sh\", \"URL-https://pwning.systems/posts/escaping-containers-for-fun/\", \"URL-https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html\", \"URL-https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation\", \"URL-https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/\", \"CVE-2022-0492\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"BINARY\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:07.699412Z"}