2 ms·

> . Kernel memory safety is not the main issue with container escapes. I disagree, I think it is the primary issue. Logical bugs are far less common. > the Li

> . Kernel memory safety is not the main issue with container escapes. I disagree, I think it is the primary issue. Logical bugs are far less common. > the Linux kernel isn't exactly trivial to exploit either these days It's not that hard, though of course exploitation hasn't been trivial since the 90s. We did it at least a few times at my company: https://web.archive.org/web/20221130205026/graplsecurity.com/blog https://web.archive.org/web/20221130205026/graplsecurity.com... Chompie certainly worked hard (and is one of if not the most talented exploit devs I've met), but we're talking about a single exploit developer developing highly reliable exploits in a matter of weeks.

_8j50 3y ago
A single talented developer taking weeks sounds about right, that's what I meant by difficult but also you have vulns that never get a cve issued or exploit developed because of kernel specific hardening. As for container escapes, there are tools like deepce: https://github.com/stealthcopter/deepce https://github.com/stealthcopter/deepce I can't honestly say I've heard of real life container escapes by attackers or pentesters using kernel exploits. Although I am sure it happens and there are people who won't update the host's kernel to patch it.