Escaping Virtualized Containers
summary
Shows a concrete escape chain against Kata containers running under Docker: a missing devices cgroup plus the default make_node capability lets a container write the guest block device, a page cache eviction technique forces guest processes to load the modified binaries (crash agent, trigger shutdown) and achieve guest code execution, then a cloud-hypervisor image persistence bug commits that change to the VM image so a second run can mount a malicious image over /bin and get host code execution. Demos work end-to-end and fixes were disclosed (CVE issued).
AI-written summary · about
chapters (17)
- 0:00Introduction to container security
- 1:00Understanding containers vs VMs
- 2:44Kata containers explained
- 4:50Use cases for Kata Containers
- 5:51Technical architecture of Kata
- 7:59Attack scenario and scope
- 9:37Container breakout techniques
- 13:01Exploiting device cgroups
- 17:50Page cache manipulation
- 20:33Guest code execution demo
- 23:54Executing the guest attack
- 26:13Escaping the virtual machine
- 29:14Host denial of service demo
- 31:18Compromising future guests
- 33:42Container to host code execution
- 36:13Shared directory vulnerabilities
- 37:50Security takeaways and conclusion
related talks
45mThe Container Escape Room: An Exploration of Container Escapes
43mA Compendium of Container Escapes
31mContainer Escape: All You Need Is Cap (Capabilities)
35mContainers Attack and Defense
32mLotsa security - confining the extra security layer
47mContainer Security
32mKubernetes Attack and Defense: Inception-Style
38mA Treasure Map of Hacking (and Defending) Kubernetes