Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Microsoft Patched the Issue With Windows Containers That Enabled Siloscape

Summary: Microsoft added security checks that block the Windows container escape Unit 42 discovered, the same flaw that enabled Siloscape, the first known vulnerability targeting Windows containers. The patch blocks any call to the undocumented function NtSetInformationSymbolicLink from a thread inside a container with the STATUS_PRIVILEGE_NOT_HELD error, using the PsIsCurrentThreadInServerSilo function to detect container threads, and covers all versions of Windows Server 2019 including 1809.

Bottom line: Unit 42 states that any process running in Windows Server containers should be assumed to have the same privileges as admin on the host, which in a Kubernetes deployment is the node itself - so the patch closes this specific escape but does not make the container a security boundary.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related