Non-Root Containers, Kubernetes CVE-2019-11245 and Why You Should Care
Summary: On May 31, the Kubernetes Product Security Committee announced CVE-2019-11245, a regression in which containers built to run as a non-root user instead ran as root on their second execution or after a restart. The flaw was specific to dockershim and affected only Kubelet v1.13.6 and v1.14.2, and was fixed by reverting a commit that broke detection of an image UID.
Key Takeaway: Running as root makes container breakout far more probable, and some escape vulnerabilities - including runc flaws CVE-2016-9962 and CVE-2019-5736 - require root privileges to exploit at all, so a silent switch back to root removes the layer that limits the damage of a breached container.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2016-9962CVE-2019-11245CVE-2019-5736
- Related
- Breaking Out of rkt – 3 New Unpatched CVEs Cyber Risks ·