Kernel exploits

A container shares the host kernel, so a kernel vulnerability a container process can reach executes on the host. Key families reachable from containers include the copy-on-write page fault race, the pipe page-cache overwrite, and netfilter nf_tables use-after-frees that an unprivileged user namespace exposes, each giving kernel read-write and then host root.

1 phút đọccập nhật 7 thg 10, 2026

1 người đóng góp

Containers do not virtualise the kernel; they share the host's single kernel through namespaces and cgroups. Any kernel code path a container process can reach is therefore an escape surface, and a successful kernel exploit lands directly on the host as root, bypassing every namespace. What a container can reach is widened enormously when it can create a user namespace, because that grants CAP_NET_ADMIN and other capabilities inside the namespace and exposes subsystems (netfilter, some filesystems) that would otherwise be unreachable.

Gauge reachability and version:

bash

uname -r                                           # exact kernel release
unshare -Urn true 2>/dev/null && echo "unprivileged userns available"
sysctl kernel.unprivileged_userns_clone 2>/dev/null

Subtopics#

Dirty COW: a copy-on-write race for writing read-only pages.
Dirty Pipe: overwriting read-only file page cache through a pipe.
nf_tables: netfilter use-after-frees reachable via an unprivileged user namespace.

Kernel exploits

Subtopics#

References#