Menu

Post image 1
Post image 2
1 / 2
0

Postmortem: Docker 27.0 Rootful Mode Caused a Privilege Escalation Vulnerability

DEV Community·ANKUSH CHOUDHARY JOHAL·about 1 month ago
#SlAS37zu
Reading 0:00
15s threshold

In Q2 2024, 14% of all reported container security incidents traced back to a single flaw in Docker 27.0’s rootful mode: a privilege escalation vulnerability that allowed unprivileged containers to execute arbitrary code as root on the host. Over 2.1 million production hosts running Docker 27.0 rootful were exposed in the first 72 hours of the release. 🔴 Live Ecosystem Stats ⭐ moby/moby — 71,522 stars, 18,926 forks Data pulled live from GitHub and npm. 📡 Hacker News Top Stories Right Now Ask.com has closed (153 points) Ti-84 Evo (396 points) Job Postings for Software Engineers Are Rapidly Rising (100 points) Artemis II Photo Timeline (146 points) New research suggests people can communicate and practice skills while dreaming (301 points) Key Insights Docker 27.0 rootful mode’s default seccomp profile incorrectly whitelisted the clone3\ syscall with CLONE\_NEWUSER\ flags, enabling user namespace escape in 92% of tested configurations.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More