A high-risk container escape vulnerability has surfaced in the related to Kubernetes pods which allows a user with a shell to get all kernel capabilities inside the container and potentially use it to escape the container into the host. This vulnerability (CVE CVE-2022-0185) is, to our knowledge, not being exploited in the wild as of January 26th 2022, however the group that discovered it will provide more information about it the coming week, which will start to surface proofs of concept and begin representing a threat. Major linux distributions have started distributing kernel patches which solve this issue.
Reach
This vulnerability is exploitable from a linux shell session on a Kubernetes container. It is not a first step in an exploit chain, but it makes privilege escalation to having all kernel capabilities trivial, which means it can bring a higher risk in systems exposed to the internet with vulnerable software (like a popular CMS or CRM) by enabling a longer, more dangerous exploit chain. all kernel versions since 5.1-rc1 are affected through the latest patches (5.4.173, 5.10.93, 5.15.1), however major distributions are already distributing patches on their kernels.
Indicators of Compromise
No clear indicators of compromise are known as of yet, but a possible check is to look for what kernel capabilities processes have, and see if any unusual process has an unusual amount of kernel capabilities.
Patches and mitigations
Kernel patches are being released by major linux distributions to mitigate this issue and should be applied as soon as possible. If a debian-based distribution does not have an available patch yet, this vulnerability can be mitigated by disabling unprivileged kernel namespaces:
sysctl -w kernel.unprivileged_userns_clone=0This way only privileged pods and containers will be able to escalate their kernel capabilities (Which is as per design for the privilege level specified).
Sources
https://sysdig.com/blog/cve-2022-0185-container-escape/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0185
Geko Cloud
Geko Cloud Consulting we are up to date with any incident or vulnerability. If you want to have your data safe, you need us!