PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why is Exposing the Docker Socket a Really Bad Idea?

blog.quarkslab.com | research | #linux | #privilege-escalation | #containers | #docker | #misconfiguration | #security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Why exposing the Docker socket is dangerous: what read/write access to /var/run/docker.sock enables, with concrete examples escalating to root on the host.
Published
Collected

Related coverage

research · blog.quarkslab.com
Reversing Windows Container, episode I: Silo
Series opener on reversing Windows Containers: the user-land internals of Silo creation, the isolation mechanism underpinning the Server Silos that Docker uses on Windows.
research · blog.quarkslab.com
Digging into the OCI Image Specification
A deep dive into the OCI image specification behind container images: how it enables moving images between hosts and sharing filesystem layers efficiently across container processes.
research · blog.quarkslab.com
Digging Into Runtimes – runc
A deep dive into runc, the standardized low-level runtime beneath Docker: container history from LXC to OCI, and how runc spawns and manages containers on Linux.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · starlabs.sg
Old Wine in a New Bottle: A Decade-Old lxd-Group Root, Re-Armed
Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Back