Re:Containers, Security, and Echo Chambers
by kentonv on Monday May 21, 2018 @12:47PM
(#17119753)
It's been a while, but IIRC Docker wasn't affected by Dirty COW because they mount /proc read-only. (Sandstorm was unaffected because it doesn't mount /proc at all.)
FWIW I haven't kept the security non-events up to date over the past year or two. There was at least one Linux kernel bug I can remember last year (CVE-2017-5123) that allowed a breakout from all container engines, because waitid() is too important a syscall to block. However, the vulnerability was newly-introduced and hadn't made its way into too many distros before it was fixed.
FWIW I haven't kept the security non-events up to date over the past year or two. There was at least one Linux kernel bug I can remember last year (CVE-2017-5123) that allowed a breakout from all container engines, because waitid() is too important a syscall to block. However, the vulnerability was newly-introduced and hadn't made its way into too many distros before it was fixed.