runc is the reference OCI runtime that actually creates and enters containers; containerd and CRI-O sit above it and manage images, shims, and lifecycle. All run as root on the host, and all handle data the container controls: the image filesystem, the process spec, working directories, mount paths, and annotations. A bug in how any of them handles that data during create, start, or exec runs with host root privilege, so these are full escapes rather than escalations.
Fingerprint the runtime versions, which decide which flaw applies:
runc --version 2>/dev/null
containerd --version 2>/dev/null
crictl version 2>/dev/null
cat /proc/self/cgroup # hints at the managing runtime
Subtopics#
- runc /proc/self/exe overwrite: overwrite the host runc binary during exec.
- Leaky Vessels: file-descriptor and working-directory leaks reaching the host filesystem.
- CRI-O cr8escape: set arbitrary host kernel parameters through a pod annotation.
- containerd shim API: reach the shim control socket to run processes on the host.