3 ms·
Are they already vulnerable to RCE as an unprivileged user? Hopefully not. An LPE only allows an attacker who can already execute code on the system to become
by arcfour 5mo ago
Are they already vulnerable to RCE as an unprivileged user? Hopefully not.
An LPE only allows an attacker who can already execute code on the system to become root. So, bad, yes, but it doesn't mean you are immediately pwned.
- hughw 5mo agoShould I rush to Lambda or ECS and turn off all my containers sharing a host with who the hell knows?
- tkel 5mo agoLike others have said, this will get you root inside the container. It isn't a container escape. File/volume mounts shared across containers would be vulnerable.
- arcfour 5mo agoFirecracker is extremely hardened, so I wouldn't worry about Lambda. As for ECS, getting root doesn't necessarily mean you have a container escape. I think you could escape containers with this exploit, but you would need a different payload than what's published. I could be wrong though. I would assume AWS is pretty on the ball when it comes to handling stuff like this if they didn't have other defenses or mitigations in place already.
- PhilipRoman 5mo agoAFAIK Lambda and everything else will use micro-VMs. No serious company would use a shared kernel design for workloads in different security contexts. (Personally I wouldn't even use the same hardware host, but sometimes sacrifices have to be made)
- account42 5mo agoAnd for a single user desktop, an LPE is almost meaningless as all the really important files are in $HOME and accessible without root.
- arcfour 5mo agoPerhaps, unless you want persistence.