Exploiting a Slightly Peculiar Volume Configuration with SIG-Honk

on YouTube ↗34m

" summary

A hacker crew reads CVE-2021-30465 in runc, builds a proof-of-concept exploit that uses an emptyDir symlink race during volume mount to win a TOCTOU and mount the host root into a container; testing uses kind, a daemonset-cached nginx image and simple bash loops, success criteria is extra PIDs visible via proc (a PID namespace view), and the PoC yields host fs access and easy docker-socket escalation. EKS shows a backported fix; work triggers discovery of CVE-2021-25741 in the kubelet.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 2:29Ian Coldwater
3. 3:52Vulnerabilities in Run C
4. 33:19Reference Material

" related talks

• 38mA Treasure Map of Hacking (and Defending) KubernetesAndrew Martin · KubeCon + CloudNativeCon Europe 2022
• 29mSecuring Container Runtimes -- How Hard Can It Be?Aleksa Sarai · Container Camp AU 2019
• 45mThe Container Escape Room: An Exploration of Container EscapesAmit Schendel · OWASP Global AppSec San Francisco 2024
• 49mAttacking and Detecting Attacks on Kubernetes ClustersJay Beale, Alana Trimble · RSA Conference 2023
• 46mThe Hacker's Guide to KubernetesPatrycja Wegrzynowicz · Voxxed Days Crete 2025
• 34mHijack a Kubernetes Cluster - a WalkthroughNico Meisenzahl · Cloud Native Rejekts NA 2021
• 57mWhat vulnerabilities? Live hacking of containers and orchestratorsLewis Denham Parry · NDC Oslo 2019
• 45mSecuring Container Runtimes -- How Hard Can It Be?Aleksa Sarai · linux.conf.au 2020