K8s Container Escape Audit has just released version 4.4. This read-only bash script is designed to be run…
Liam R. — Freelance Penetration Tester
K8s Container Escape Audit has just released version 4.4. This read-only bash script is designed to be run inside a pod to identify escape vectors to the node, specifically aimed at penetration testers and security teams conducting authorized assessments.
What's new in this release:
• Check 52: a best-effort container runtime version probe (runc / containerd / cri-o) that provides real detection signals for runc escape CVEs rather than just inventory tracking.
• Seven additional dangerous capabilities decoded, including CAP_BPF, CAP_PERFMON, CAP_MKNOD, CAP_DAC_OVERRIDE, and more.
• Coverage added for classic runc escapes: CVE-2019-5736 and CVE-2024-21626 ("Leaky Vessels").
• Detection of no_new_privs, expanded RBAC probes (impersonate, pods/attach), and auditing of vsock/rds_tcp modules.
In total, there are 52 checks, 27 CVEs in the database, all strictly read-only, with SLSA Build L3 provenance included in every release. This tool is free for non-commercial use (CC BY-NC 4.0). Feedback and pull requests are welcome.
Check it out at: https://lnkd.in/en9mzDkn
#Kubernetes #ContainerSecurity #CloudNative #DevSecOps #PenTesting #K8s
2 reactions · 0 comments
Topics: #devsecops, #k8s, #kubernetes, #containersecurity, #cloudnative, #pentesting