3 ms·
It says in the post that you can execute arbitrary code in the kernel. So, full compromise of the system. (In the case of Docker, perhaps you can even escape to
by 0x0 10y ago
It says in the post that you can execute arbitrary code in the kernel. So, full compromise of the system. (In the case of Docker, perhaps you can even escape to the root system?)
- andrewstuart2 10y agoAFAIK Docker is still not considered ready to run untrusted code on shared machines. If you want to run untrusted code, you should just use a VM anyway.
- raesene6 10y agoEven with a VM you need to be somewhat careful as hypervisor breakouts are not unknown.
- jeffmcjunkin 10y agoAbsolutely. That said, the Linux kernel is a helluva lot more attack surface than the relatively few hypercalls provided by most Type 1 hypervisors.
- staticassertion 10y agoShould be able to escape docker with this. Docker provides host kernel access, so if you get the kernel you're good to go.