PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Digging into Linux namespaces - part 2

blog.quarkslab.com | research | #linux | #containers | #kernel | #isolation | #cgroups | #namespaces
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of the Linux namespaces series: USER, MNT, UTS, IPC and CGROUP namespaces examined, then combined to build a fully isolated environment for a process.
Published
Collected

Related coverage

research · blog.quarkslab.com
Digging into Linux namespaces - part 1
Part one of the Linux namespaces series: what namespaces are, how they give processes independent system views, and the clone/unshare syscalls used to create them.
research · blog.quarkslab.com
Reversing Windows Container, episode I: Silo
Series opener on reversing Windows Containers: the user-land internals of Silo creation, the isolation mechanism underpinning the Server Silos that Docker uses on Windows.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
blog · projectzero.google
Taking a page from the kernel's book: A TLB issue in mremap()
This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.
vulnerability · projectzero.google
Exploiting the Linux kernel via packet sockets
A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.
blog · projectzero.google
Exploiting Recursion in the Linux Kernel
A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.
Back