Container Breakouts: Escape Techniques in Cloud Environments
Summary: Unit 42 reviews container escape techniques, in which an attacker with low-privilege access to a container exploits misconfigurations and vulnerabilities to break out, and notes that many containers are internet-facing. The article details user-mode helper methods, including a cgroup release_agent escape presented by Brandon Edwards and Nick Freeman at Black Hat USA 2019, which lets an attacker with root privileges execute any program with root privileges on the host using a few shell commands.
Why it matters: Containers share the host kernel and often lack complete isolation from host user-mode, so a single retained high-privilege capability or misconfigured cgroup can turn a low-privilege container foothold into root-level execution on the host.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Mentions
- CVE-2019-5736
- Related
- Breaking Out of rkt – 3 New Unpatched CVEs Cyber Risks ·