/proc/self/exe overwrite from within a user namespace I work on Drop , a Linux sandboxing tool that uses user namespaces. As part of the work I have reviewed past vulnerabilities in similar programs. One such vulnerability was CVE-2019-5736 ; it allowed rogue processes that ran within a Docker container to escape the container by overwriting the container initialization binary (runc) exposed to…