Vulnerability (CVE)
A runC vulnerability reported on 2019-02-11, CVE-2019-5736, was found by Adam Iwaniuk and Borys Poplawski and affects Docker containers running in default settings, allowing an attacker to overwrite the host runC binary and gain root-level access on the...
A Unit 42 researcher found three unpatched vulnerabilities in the CoreOS rkt container runtime that let an attacker compromise the host when a user runs 'rkt enter' into an attacker-controlled pod, because binaries executed that way run as root with all...
On May 31, the Kubernetes Product Security Committee announced CVE-2019-11245, a regression in which containers built to run as a non-root user instead ran as root on their second execution or after a restart. The flaw was specific to dockershim and...
Unit 42 researchers found that Azure Container Instances ran an outdated runC (v1.0.0-rc2, released Oct. 1, 2016) vulnerable to container-breakout CVEs, letting them escape to a Kubernetes node and obtain a 'bridge' service account token with cluster-wide...
Unit 42 reviews container escape techniques, in which an attacker with low-privilege access to a container exploits misconfigurations and vulnerabilities to break out, and notes that many containers are internet-facing. The article details user-mode helper...