5 ms·
> [...] that root was just my unprivileged podman user on the host Couldn't you then simply re-run the exploit again as unprivileged podman user and gain root
by Titan2189 5mo ago
> [...] that root was just my unprivileged podman user on the host
Couldn't you then simply re-run the exploit again as unprivileged podman user and gain root on the host?
- tuananh 5mo agodid anyone try it? it suppose to work right?
- kelnos 5mo agoNo, because you're still in the container, and there's no route to the host's root from there. If you can orchestrate a container escape from the container's "root", then you're on to something.
- wang_li 4mo agoThis pollutes the page cache, which affects the entire host. Getting "root" in a rootless container may mean nothing. But if it attacked the ls, ps, cat, grep, etc. commands and any process outside the container invokes that command it runs the payload of the attacker. What if the payload of the attack is just the same attack to escalate to root? So now you have escaped the container and gained root.