3 ms·
It's been a while, but IIRC Docker wasn't affected by Dirty COW because they mount /proc read-only. (Sandstorm was unaffected because it doesn't mount /proc at
by kentonv 8y ago
It's been a while, but IIRC Docker wasn't affected by Dirty COW because they mount /proc read-only. (Sandstorm was unaffected because it doesn't mount /proc at all.)
FWIW I haven't kept the security non-events up to date over the past year or two. There was at least one Linux kernel bug I can remember last year (CVE-2017-5123) that allowed a breakout from all container engines, because waitid() is too important a syscall to block. However, the vulnerability was newly-introduced and hadn't made its way into too many distros before it was fixed.