container_escape_audit.sh — recent updates (v4.7.9) A quick update on the read-only container-escape and…
Liam R. — Freelance Penetration Tester
container_escape_audit.sh — recent updates (v4.7.9)
A quick update on the read-only container-escape and privilege-escalation auditor for Linux and Kubernetes nodes — a single Bash script, no dependencies, makes zero changes to the host it runs on.
The last few releases have pushed on two fronts: depth and accuracy.
Mandatory access control, done properly. The AppArmor/SELinux checks no longer just answer "is it enabled?" They now report how it's confining you — AppArmor complain mode (logs violations but blocks nothing, so it looks protected while enforcing nothing), SELinux domain and MCS separation (spc_t / unconfined_t vs a properly confined container_t), and whether a MAC module is actually loaded in the active kernel stack.
KVM/x86 exposure (v4.7.9). A new read-only probe for the x86 KVM shadow-MMU escapes (Zapscape, Januscape). The detail most write-ups skip: on RHEL, AlmaLinux, Rocky and CloudLinux, /dev/kvm is world-writable (0666) — so these are a direct unprivileged-to-root LPE, and a container escape wherever /dev/kvm is exposed, not the nested-virt-only issue they're usually described as.
CVE coverage kept current, and scored honestly. Recent additions include SCTPhantom (CVE-2026-64564) and the xfrm nat_keepalive double-free (CVE-2026-72137). On the latter we deliberately corrected the published 9.8 "remote" secondary score down to a realistic 7.8 local LPE — the free is on the local transmit path, not remotely reachable. A scanner that parrots an inflated CVSS is worse than one that says nothing.
Read-only throughout. Feedback and PRs welcome.
github.com/liamromanis101/K8s-container_escape_audit
#ContainerSecurity #Kubernetes #LinuxSecurity #DevSecOps #CVE
3 reactions · 0 comments
Topics: #devsecops, #kubernetes, #cve, #containersecurity, #linuxsecurity