GitHub - liamromanis101/K8s-container_escape_audit: Look for possible escape vectors from a container
Liam R. — Freelance Penetration Tester
K8s-container_escape_audit v4.8.0 Released
CVE database: 43 → 51 entries (done as conf-only work under v4.7.9, then bundled into the v4.8.0 release)
xfrm nat_keepalive double-free (CVE-2026-72137) — local LPE via CAP_NET_ADMIN/userns; scored HIGH/7.8 with the published 9.8 secondary CVSS corrected down (it's local, not remote).
runc trio promoted to first-class entries — CVE-2025-31133, -52565, -52881 (were behavioural-only via checks 26/52).
ksmbd LPE (CVE-2025-37947) — OOB write, public Doyensec exploit, module-gated.
2024 backdate: io_uring PBUF UAF (CVE-2024-0582) — genuine HIGH LPE, public Exodus exploit.
Two io_uring re-adds at honest LOW — CVE-2025-40364 (vendor-rated DoS) and CVE-2025-21863 (Spectre-v1 hardening).
Removed CVE-2025-21333 — it was a Windows Hyper-V CVE misattributed as Linux (net effect of the io_uring saga: +2 kept, 1 correctly excluded).
The broader framing: relevant escapes/LPEs are now backdated to 2024, and the README's Recent CVEs table was brought to full 51-entry parity (SCTPhantom/Zapscape had been prose-only).
New capability — v4.8.0: --network (check 61)
Opt-in, off by default, first capability that makes outbound connections.
Detects unauthenticated Redis, etcd, Memcached, Docker API, Elasticsearch, MongoDB reachable from the Pod.
Connect-and-identify only — one read-only command, no writes/exploitation.
Severity: etcd + Docker API → CRITICAL, Redis + ES → HIGH, Memcached → MEDIUM, Mongo → LOW (reachability only).
Scoped to localhost + node gateway + injected K8s service endpoints — no arbitrary CIDR sweeps.
https://github.com/liamromanis101/K8s-container_escape_audit
#linux #kubernetes #cks #redis #docker #cve
2 reactions · 0 comments
Topics: #redis, #kubernetes, #cve, #docker, #cks, #linux