Towards Improving Container Security by Preventing Runtime Escapes [Slides]
Abstract not provided.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
Engineering topics
Reeves, Michael
Publications and source records attributed to Reeves, Michael.
Towards Improving Container Security by Preventing Runtime Escapes
Container escapes enable the adversary to execute code on the host from inside an isolated container. Notably, these high severity escape vulnerabilities originate from three sources: (1) container profile misconfigurations, (2) Linux kernel bugs, and (3) container runtime vulnerabilities. While the first two cases have been studied in the literature, no works have investigated the impact of container runtime vulnerabilities. In this paper, to fill this gap, we study 59 CVEs for 11 different container runtimes. As a result of our study, we found that five of the 11 runtimes had nine publicly available PoC container escape exploits covering 13 CVEs. Our further analysis revealed all nine exploits are the result of a host component leaked into the container. Here, we apply a user namespace container defense to prevent the adversary from leveraging leaked host components and demonstrate that the defense stops seven of the nine container escape exploits.
42 ENGINEERING↗
Measuring Aerosol Size Distributions from the NASA DC-8 in SOLVE II
The University of Denver Focused Cavity Aerosol Spectrometer (FCAS 11) and Nucleation-Mode Aerosol Size Spectrometer (N-MASS) were successfully integrated and flown aboard NASA s DC-8 for the second SAGE I11 Ozone Loss and Validation Experiment (SOLVE 11). Both instruments performed well during SOLVE, with virtually complete data coverage for all mission and test flights. The few exceptions to this were the occasional simultaneous zero-check for the instruments, and some data loss for channel 4 of the N-MASS. The only consequence of the latter is reduced resolution in the 15 to 60 nm range for the affected size distributions.
Reeves, Michael↗