4 ms·

I know of only one Solaris Zone escape CVE in its entire existence. http://www.cvedetails.com/cve/CVE-2008-5689/ http://www.cvedetails.com/cve/CVE-2008-5689/

• JoshTriplett 11y ago
  Oracle doesn't tend to disclose security vulnerabilities; they just silently fix them; the absence of CVEs is not the absence of vulnerabilities. On top of that, a vulnerability wouldn't need to be Zones-specific; almost any kernel exploit would work, unless it uses a syscall that only works in the "global" zone.
  • feld 11y ago
    You forget that Sun was in charge of Solaris for many years and was pretty open about such things.
• benmmurphy 11y ago
  Any exploit against the kernel gaining code execution is a Solaris Zone escape or Freebsd jail escape. Solaris got hit by the one in 2012 which is the non-canonical RIP which hit a bunch of operating systems. FreeBSD has had numerous kernel exploits which could be used for zone escapes.
  • feld 11y ago
    Really? Which ones? I'm pretty sure local privilege exploits that give you root don't magically jump you into JID 0 (prison0), escaping the jail. You'd just have "root" in the jail. edit: well i guess if your attacker knows you're on FreeBSD they could override to prison0 in the exploit. But it's a good thing we dont have a ton of local priv exploits, eh? edit2: and that was a pretty ignorant statement of mine about root exploits anyway :)