Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Digging Inside Azure Functions: HyperV Is the Last Line of Defense

Summary: Unit 42 researchers broke out of an Azure Functions container to the underlying host, which turned out to be a HyperV virtual machine hosting several other serverless functions. They gained root inside the container by abusing an init binary function that binds files as root without privileges, then used Felix Wilhelm's cgroup escape exploit, which worked because the container had SYS_ADMIN and lacked the usual AppArmor restriction.

Why it matters: The escape had no immediate impact because the host only ran functions the researchers' Azure user could already access, but the researchers note the virtual machine could hold secrets that shouldn't be visible, and a separate vulnerability in that VM would change the stakes considerably.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related