Container Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
summary
Demonstrations show ptrace, perf and eBPF can be abused from inside containers to read memory, inject code, load kernel hooks and persist via eBPF rootkits; known CVEs such as CVE‑2019‑5736 are still exploitable in many clusters and attack chains are reproducible in a lab. Containers commonly retain cap_sys_ptrace and cap_bpf or allow perf; perf PMU counters are global so cross‑container leakage is practical. Recommended fixes include dropping caps, apply runtime default seccomp profile, set kernel.yama.ptrace_scope and disallow unprivileged eBPF and hostPID where unnecessary.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:24Container isolation matters
- 8:23Debugging interfaces attack
- 12:14Linux security quiz
- 14:42Ptrace and perf events
- 17:30eBPF and kernel risks
- 19:15Attack chain and CVEs
- 23:06Production hardening
- 26:19Key takeaways
- 28:56Q&A
related talks
45mThe Container Escape Room: An Exploration of Container Escapes
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
40mExploring Runtime Security and Forensic using eBPF
42mResolving Performance and Security Issues with eBPF
31mContainer Escape: All You Need Is Cap (Capabilities)
26mImplementing Container Privilege Escalation Detection using eBPF for Cloud Native Security
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
25mDrawing Lines in the Sand, or Running Unprivileged eBPF in Kubernetes