K8s Container Escape Audit v4.5 is out This release rebuilds how the tool decides whether a kernel is…
Liam R. — Freelance Penetration Tester
K8s Container Escape Audit v4.5 is out
This release rebuilds how the tool decides whether a kernel is actually vulnerable, because "is my kernel affected?" is a harder question than most scanners admit.
A naive version check gets this wrong in both directions. It clears patched kernels (a distro back-ports the fix but the base version string never changes) and it misses vulnerable ones (an affected range nobody encoded). Both are dangerous in a security tool.
So v4.5 now:
• Reads authoritative NVD CPE ranges per CVE and judges vanilla kernels against the full affected-set
• Detects your distro, release, kernel flavour (generic/aws/azure/gcp) and package version, then compares with the correct scheme — Debian dpkg rules, Ubuntu ABI.upload, or upstream-stable, never one comparator for all
• Returns an honest verdict: vulnerable / not-affected / defer-to-vendor / unknown — and never silently passes on missing data
Re-verifying all 20 kernel CVEs against NVD also caught real bugs in the old data: a duplicated CVE ID, several wrong "introduced" versions, and affected ranges that had been leaving older vulnerable kernels undetected.
Read-only, runs inside a pod, SLSA Build L3 signed.
👉 github.com/liamromanis101/K8s-container_escape_audit
#Kubernetes #ContainerSecurity #CloudNative #DevSecOps #LinuxKernel
2 reactions · 0 comments
Topics: #devsecops, #kubernetes, #containersecurity, #linuxkernel, #cloudnative