masasron/CopyEscape-CVE-2026-17106

GitHubRepository PoCExploit

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a proof-of-concept exploit for CVE-2026-17106 that uses a TOCTOU race condition in Docker's `docker cp` to write arbitrary files outside the intended destination on the host. It includes two complete exploit implementations: a Linux variant that overwrites `/usr/bin/runc` with a malicious script, and a macOS variant that creates a marker file in the user's home directory.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept exploit for CVE-2026-17106. All code serves the documented purpose of demonstrating a Docker cp TOCTOU vulnerability. The Linux monitor writes a replacement /usr/bin/runc and the macOS monitor writes ~/pwnd, both as described in the README. No concealed backdoor, unrelated payload, or operator-directed harm beyond the stated exploit behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesCShell
Target softwareDocker EngineDocker CLIDocker Desktop
Attack typesTOCTOU race conditionsymlink attackcontainer escape
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, functional code that exercises the vulnerability to achieve unauthorized file writes on the host. The Linux monitor.c writes a malicious script to /usr/bin/runc (line 123) and the macOS monitor.c writes a marker to ~/pwnd (line 148). The README explicitly describes these as demonstrations that 'overwrites /usr/bin/runc' and 'creates ~/pwnd', which are exploitation actions, not mere detection.

README.md:15-17linux/monitor.c:123macos/monitor.c:148

Requirements

  • A vulnerable Docker Engine or Docker Desktop release (tested against Docker Engine/CLI 29.6.1 and Docker Desktop 4.81.0).README.md:26-33
  • A running Docker daemon and Docker CLI access.README.md:27-28
  • Root privileges for the Linux variant that overwrites /usr/bin/runc.README.md:29

Observed behavior

  • The Linux exploit monitor (monitor.c) sets up a directory layout with a staged symlink pointing to /usr/bin, then uses inotify to detect when Docker accesses a trigger file during `docker cp`. It races the archive creation by atomically replacing a directory with the symlink, causing the Docker CLI to follow the symlink and write a malicious payload to /usr/bin/runc.linux/monitor.c:117-131linux/monitor.c:133-146linux/monitor.c:148-226
  • The macOS exploit monitor (monitor.c) similarly races `docker cp` to create a symlink to the user's home directory, causing the CLI to write a marker file (~/pwnd) outside the intended copy destination.macos/monitor.c:142-156macos/monitor.c:158-171macos/monitor.c:173-251
  • Both exploits use an LD_PRELOAD library (watched_preload.c) to hide the underlying directory structure from processes inside the container, making /watched/file.txt appear as a regular file.linux/watched_preload.c:31-37macos/watched_preload.c:31-37
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Linux monitor writes a replacement /usr/bin/runc script that creates /imperva_red_teamMatches the documented Linux PoC behavior in README.md lines 15-17 and 130-136linux/monitor.c:123README.md:15-17
Exploit Behavior
macOS monitor writes ~/pwnd with contents COPYESCAPE_MACOS_DEMOMatches the documented macOS PoC behavior in README.md lines 13-14 and 57-65macos/monitor.c:148README.md:13-14
Exploit Mechanism
LD_PRELOAD library redirects file operations on /watched/file.txt to a backing fileUsed to hide the directory nature of /watched/file.txt from container processes, as described in README.md lines 161-166linux/watched_preload.c:31-36README.md:161-166
Review boundaries

What the analysis did not establish

  • Three files (likely Dockerfiles and build scripts) are omitted from the evidence due to text budget constraints, but the core exploit logic in the C source files and shell scripts is fully included.
  • The evidence does not include the compiled binaries; analysis is based solely on the provided source code.
  • Three files (likely Dockerfiles or build artifacts) were omitted from the text evidence; their content was not reviewed, but metadata indicates no binary payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

linux

Created Vuln labNo linked CVEDockerfile

1 Dockerfile

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Environment assessment

A single-container Linux environment that demonstrates a Docker `docker cp` vulnerability (CVE-2026-17106). It builds a monitor and a preload library to race the Docker archive producer, causing a symlink-based escape that overwrites `/usr/bin/runc` on the Docker host.

README.md:1-8linux/Dockerfile:1-22

Lab assessment

Vulnerability lab

The README explicitly states it is a proof-of-concept repository for CVE-2026-17106, a Docker `docker cp` vulnerability. The Dockerfile builds a monitor and a preload library designed to create a race condition, and the README provides step-by-step instructions to trigger the vulnerability and overwrite a host binary.

README.md:1-8README.md:10-14
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

minimal-monitor

race orchestratorsymlink pivot

A C program that sets up a directory layout under `/watched/`, including a symlink to `/usr/bin`, and uses inotify to detect when the Docker daemon accesses a trigger file. Upon detection, it atomically renames directories to replace a directory with the symlink, causing the Docker CLI to follow the symlink and write to the host's `/usr/bin/runc`.

linux/monitor.c:1-233linux/Dockerfile:7

libwatchedfile.so

file redirectionLD_PRELOAD library

A shared library that intercepts file operations (open, openat, fopen, stat, lstat) and redirects accesses to `/watched/file.txt` to a backing file `/watched/.file.txt.regular`. This makes the path appear as a regular file to processes inside the container while the Docker daemon sees a directory.

linux/watched_preload.c:1-89linux/Dockerfile:8

minimal-entrypoint

entrypoint scriptLD_PRELOAD unsetter

A shell script that unsets the `LD_PRELOAD` environment variable before executing `minimal-monitor`. This ensures the monitor itself does not have its file operations redirected by the preload library.

linux/entrypoint.sh:1-3linux/Dockerfile:14
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A vulnerable Docker Engine or Docker Desktop release (tested against Docker Engine/CLI 29.6.1 and Docker Desktop 4.81.0).README.md:20-22
  • A running Docker daemon and a shell with Docker CLI access.README.md:20-22
  • Root privileges on the Docker host to overwrite `/usr/bin/runc`.README.md:23
  • The container must be started with `docker run` and the vulnerability triggered by a separate `docker cp` command from the host.README.md:100-110

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.README.md:97-99
  2. Start the container with `docker run --name copyescape-linux copyescape-linux`.README.md:101-103
  3. Verify the prepared path looks like a regular file from inside the container using `docker exec copyescape-linux cat /watched/file.txt`.README.md:105-110
  4. Trigger the vulnerability by running `docker cp copyescape-linux:/watched/file.txt ./file.txt` from the host.README.md:112-114
  5. Observe that `/usr/bin/runc` on the host has been overwritten with a PoC shell script, and a marker file `/imperva_red_team` is created when the replaced runtime is executed.README.md:116-120
  6. Restore the original `runc` binary from the backup and clean up test artifacts.README.md:122-138
Safety-review evidence

Behaviors behind the stored safety assessment

Suspicious behavior

The lab is a documented vulnerability demonstration that intentionally overwrites the host's `/usr/bin/runc` binary with attacker-controlled content and creates a root-owned marker file `/imperva_red_team`. While the README discloses this behavior and provides restoration steps, the concrete host impact (overwriting a critical system binary) is severe and constitutes a suspicious indicator. The behavior is not automatically directed at an unrelated system, but it modifies the Docker host itself, which is the operator's machine.

README.md:116-120linux/monitor.c:120-126

Indicators requiring review

  • The monitor writes a shell script to `/usr/bin/runc` on the host, replacing the Docker runtime with attacker-controlled content.linux/monitor.c:120-126README.md:116-120
  • The replaced `runc` script creates a root-owned marker file `/imperva_red_team` when executed.linux/monitor.c:124README.md:118-120
Review boundaries

What the analysis did not establish

  • The packet does not include the macOS demonstration files, only the Linux PoC.
  • The CVE ID CVE-2026-17106 is mentioned in the README and repository metadata but is not present in the unit's cve_association.unit_cve_ids, so no CVE assessment is performed.
  • The safety assessment relies on the README's description of the host impact; the actual runtime behavior of the compiled binaries is not independently verified.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

macos

Created Vuln labNo linked CVEDockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based proof-of-concept environment for CVE-2026-17106 (CopyEscape), demonstrating a TOCTOU race in 'docker cp' that writes a marker file (~/pwnd) on the macOS host. The unit consists of a Dockerfile, entrypoint script, monitor binary source, LD_PRELOAD library source, and a runner script.

README.md:1-8macos/Dockerfile:1-22

Lab assessment

Vulnerability lab

The README explicitly states this is a proof-of-concept for CVE-2026-17106, a vulnerability in 'docker cp'. The Dockerfile builds a monitor and LD_PRELOAD library that orchestrate a race condition to write outside the container's intended copy destination. The runner script (demo-macos.sh) automates the exploit demonstration.

README.md:1-8macos/demo-macos.sh:1-88
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

minimal-monitor

race orchestratorinotify watchersymlink pivot executor

Compiled from monitor.c. Sets up a directory layout under /watched, creates a symlink to the host home directory, and uses inotify to detect when 'docker cp' opens /watched/file.txt/aaa.txt. On that trigger, it atomically renames directories to replace a directory with the symlink, causing the tar extraction to follow the symlink and write ~/pwnd on the host.

macos/monitor.c:1-259macos/Dockerfile:7-8

libwatchedfile.so

LD_PRELOAD libraryfile access redirection

Compiled from watched_preload.c. Interposes open, openat, fopen, stat, and lstat to redirect accesses from /watched/file.txt to /watched/.file.txt.regular. This makes the path appear as a regular file to processes inside the container while the underlying filesystem object is a directory.

macos/watched_preload.c:1-89macos/Dockerfile:9

minimal-entrypoint

entrypoint scriptLD_PRELOAD unsetter

A shell script that unsets LD_PRELOAD before executing minimal-monitor, ensuring the monitor itself is not affected by the preload library.

macos/entrypoint.sh:1-3macos/Dockerfile:20

demo-macos.sh

automated PoC runnerenvironment validatorcleanup handler

A shell script that builds the Docker image, runs the container with the host home directory as an environment variable, waits for readiness, executes 'docker cp', and verifies that ~/pwnd was created. It includes safety checks to avoid overwriting existing files.

macos/demo-macos.sh:1-88
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A vulnerable Docker Engine or Docker Desktop release (tested against Docker Engine/CLI 29.6.1 and Docker Desktop 4.81.0).README.md:24-28
  • A running Docker daemon and a shell with Docker CLI access.README.md:24-28
  • The host must be macOS with a home directory under /Users/<username>.macos/demo-macos.sh:10-12macos/monitor.c:47-55
  • The marker file ~/pwnd and the local copy destination file.txt must not already exist.macos/demo-macos.sh:36-42

Evidence-described exercise path

  1. Build the Docker image using 'docker build --tag copyescape-macos-demo:local .' from the macos directory.macos/demo-macos.sh:50-51
  2. Run the container in detached mode with the host home directory passed as COPYESCAPE_HOST_HOME.macos/demo-macos.sh:53-56
  3. Wait for the container to become ready by checking that 'docker exec cat /watched/file.txt' returns content.macos/demo-macos.sh:58-67
  4. Trigger the vulnerability by running 'docker cp <container>:/watched/file.txt ./file.txt'.macos/demo-macos.sh:69-70
  5. Verify that the marker file ~/pwnd was created on the host with the expected content.macos/demo-macos.sh:75-82
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The visible behavior is limited to the intended vulnerability demonstration: creating a non-destructive marker file (~/pwnd) on the macOS host via a 'docker cp' race. The runner script includes safety checks to prevent overwriting existing files, and the monitor only writes a benign marker. No hidden persistence, credential theft, backdoor, or external communication is observed. The escape is the documented purpose of the lab.

macos/demo-macos.sh:36-42macos/monitor.c:130-131README.md:10-12
Review boundaries

What the analysis did not establish

  • The packet does not include the linux/ PoC directory, so the high-impact runc overwrite demonstration is not assessed.
  • The CVE-2026-17106 identifier is not present in the unit_cve_ids array; the assessment relies solely on the README claim.
  • The compiled binaries (minimal-monitor, libwatchedfile.so) are not inspected; their behavior is inferred from the provided source code.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1