Kernel exploits

A container shares the host kernel, so a kernel vulnerability a container process can reach executes on the host. Key families reachable from containers include the copy-on-write page fault race, the pipe page-cache overwrite, and netfilter nf_tables use-after-frees that an unprivileged user namespace exposes, each giving kernel read-write and then host root.

1 min di letturaaggiornato il 7 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

Containers do not virtualise the kernel; they share the host's single kernel through namespaces and cgroups. Any kernel code path a container process can reach is therefore an escape surface, and a successful kernel exploit lands directly on the host as root, bypassing every namespace. What a container can reach is widened enormously when it can create a user namespace, because that grants CAP_NET_ADMIN and other capabilities inside the namespace and exposes subsystems (netfilter, some filesystems) that would otherwise be unreachable.

Gauge reachability and version:

bash
uname -r                                           # exact kernel release
unshare -Urn true 2>/dev/null && echo "unprivileged userns available"
sysctl kernel.unprivileged_userns_clone 2>/dev/null

Subtopics#

  • Dirty COW: a copy-on-write race for writing read-only pages.
  • Dirty Pipe: overwriting read-only file page cache through a pipe.
  • nf_tables: netfilter use-after-frees reachable via an unprivileged user namespace.

References#

PrecedenteCRI-O kernel parameter injectionSuccessiva Dirty COW