News for hackers. Stuff that matters.

A comment on Escaping Docker container using waitid() – CVE-2017-5123. Parent comment

Re:Escaping Docker container using waitid() – CVE-2017-5123 by jwilk on Friday December 29, 2017 @02:58PM (#16031591)
> Additionally this CVE relies on the getuid syscall being available, there is no reason to give a container this syscall, you should block it,

Huh? Lots of legitimate things will break without working getuid().

> you should block it, ala this guide

getuid() doesn't require any capabilities, so it can't be blocked by taking them away.

[ Parent | on HN ]
Re:Escaping Docker container using waitid() – CVE-2017-5123 by hacknat on Friday December 29, 2017 @04:45PM (#16032221)
Oops good call. I meant setuid, but either way I was wrong.
[ Parent | on HN ]