2 ms·
It might protect against the current in-the-wild exploit. It sounds like it modifies a binary/library so if the container doesn't share binaries/libraries with
by benmmurphy 10y ago
It might protect against the current in-the-wild exploit. It sounds like it modifies a binary/library so if the container doesn't share binaries/libraries with other containers or the root namespace then you are fine. (well fine in the sense that there is no privilege escalation from the container to outside the container or across into another container.) However, there are other interesting read only pages that are shared by everyone that might be targeted (VDSO?).