News for hackers. Stuff that matters.

A comment on 51% of 4M Docker images have critical vulnerabilities. Parent comment

Re:51% of 4M Docker images have critical vulnerabilities by foldr on Thursday December 17, 2020 @08:11AM (#25455228)
But non-root users within the container can also access mounted volumes, no? Is there some kind of exploit that only works if running as root?
[ Parent | on HN ]
Re:51% of 4M Docker images have critical vulnerabilities by lights0123 on Thursday December 17, 2020 @08:35AM (#25455397)
You can setuid root in a volume mounted in host. If that's executed at all by any user, bam you have root on the host.

If it's never executed, I don't know what vulnerabilities they were talking about.

[ Parent | on HN ]
Re:51% of 4M Docker images have critical vulnerabilities by foldr on Thursday December 17, 2020 @08:54AM (#25455559)
Right, but it seems that wouldn't require the app within the Docker container to be running as root to work?
[ Parent | on HN ]