TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Container escape flaw fixed in CRI-O runtime engine

87 pointsby whiteyfordabout 3 years ago

2 comments

raesene9about 3 years ago
The original write-up is linked from this post <a href="https:&#x2F;&#x2F;www.crowdstrike.com&#x2F;blog&#x2F;cr8escape-new-vulnerability-discovered-in-cri-o-container-engine-cve-2022-0811&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.crowdstrike.com&#x2F;blog&#x2F;cr8escape-new-vulnerability...</a> - Good, lots of details on exact reproduction.<p>One idea for mitigation before you can get a patch out for this would be to use admission control (e.g. OPA&#x2F;Kyverno) to block setting custom sysctls altogether or blocking the characters used in the attack. There&#x27;s some notes on that <a href="https:&#x2F;&#x2F;blog.aquasec.com&#x2F;cve-2022-0811-cri-o-vulnerability" rel="nofollow">https:&#x2F;&#x2F;blog.aquasec.com&#x2F;cve-2022-0811-cri-o-vulnerability</a> and Kyverno have a mention of the finer grained policy <a href="https:&#x2F;&#x2F;twitter.com&#x2F;kyverno&#x2F;status&#x2F;1504499323324678145" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;kyverno&#x2F;status&#x2F;1504499323324678145</a><p>One thing that&#x27;s worth noting is that to exploit this the attacker needs create pod rights (or rights to create a workload type that then creates pods), so it&#x27;s probably not critical for every cluster.
评论 #30728635 未加载
e44858about 3 years ago
Would Podman rootless prevent such exploits? You could run each pod under a separate user that has no access to important files.