Rootless Containers: The Next Trend in Container Security
Summary: Unit 42 researcher Aviv Sasson reviewed the internals of rootless containers, which use a Linux kernel feature allowing unprivileged users to create user namespaces, and found a use-after-free vulnerability in the Slirp networking component that crashes the container's network stack. The flaw, CVE-2020-1983, affects Slirp versions 4.0.0 to 4.2.0 and stems from Slirp not verifying the size of fragmented IP packets larger than 65,535 bytes.
What's compelling: Rootless containers are pitched as a security layer, but their networking components carry their own history: LXC-user-nic has had privilege-escalation flaws such as CVE-2017-5985 and CVE-2018-6556, and other libslirp bugs like CVE-2020-8608 and CVE-2020-7039 could lead to code execution and an eventual breakout from the container to the host.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026