{"vulnerability": "CVE-2020-14386", "sightings": [{"uuid": "bad260be-51ca-41b7-b393-4e22bcc2fe7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/sec_devops/143", "content": "\u0417\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043c\u0435\u0442\u043a\u0430 \"Impact of CVE-2020-14386 on Kubernetes and Containers (Docker)\" \u043b\u0438\u0448\u043d\u0438\u0439 \u0440\u0430\u0437 \u043d\u0435 \u0434\u0430\u0435\u0442 \u0437\u0430\u0431\u044b\u0442\u044c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0445\u043e\u0441\u0442\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 Kubernetes \u044d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u0447\u0430\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Kubernetes \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. \n\n\u0417\u0434\u0435\u0441\u044c \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Linux - CVE-2020-14386, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root'\u0430 \u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 Node, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0432\u043d\u0443\u0442\u0440\u0438 Pod'\u0430 \u0441 CAP_NET_RAW capability.\n\n\u0415\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u0430\u044f \u0438 \u043d\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u0435\u043b\u0430\u0442\u044c \"container escape\". \u0418 \u0432\u0441\u0435 \u044d\u0442\u043e \u043d\u0438\u043a\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u0438 \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0430\u043c\u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u0442\u044c, \u043d\u0435 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c.\n\n\u0427\u0442\u043e \u0432 \u0442\u0430\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0434\u0435\u043b\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b?\n1) \u041c\u043e\u0436\u043d\u043e/\u043d\u0443\u0436\u043d\u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u0442\u044c \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u0432\u0430\u0448\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0422\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e, \u0447\u0442\u043e \u0440\u0430\u043d\u0435\u0435 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0443 \u0432\u0430\u0441 \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u043e. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0432\u0430\u043c \u043b\u043e\u0432\u0438\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \"container escape\", \u043d\u043e \u0438 \u0434\u0440\u0443\u0433\u0443. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 (Lateral Movement, \u0437\u0430\u043f\u0443\u0441\u043a \u043c\u0430\u043d\u0435\u0439\u0440\u043e\u0432 \u0438 \u0442.\u0434.)\n2) \u041c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c\u0441\u044f \u043a \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c/\u0443\u0441\u0438\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u043c Low-level Runtime (OCI Runtimes) \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0433\u043e\u0432\u043e\u0440\u0438\u043b\u0438 \u0440\u0430\u043d\u0435\u0435. \u041d\u043e \u0441\u0442\u043e\u0438\u0442 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c, \u0447\u0442\u043e \u043e\u043d\u0438, \u043a\u0430\u043a \u0438 \u043b\u044e\u0431\u043e\u0435 \u041f\u041e \u0441\u0430\u043c\u0438 \u043d\u0435 \u0437\u0430\u0441\u0442\u0440\u0430\u0445\u043e\u0432\u0430\u043d\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0430 \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u043e \u0443\u043c\u0435\u043d\u044c\u0448\u0430\u044e\u0442 \u0438 \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0442 attack surface. \u0422\u0430\u043a GKE Sandbox \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e gVisor.", "creation_timestamp": "2020-09-23T09:27:43.000000Z"}, {"uuid": "7d30f4ca-a7ec-48cd-bad8-276ce6b1ddda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/k8security/154", "content": "\u0412 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0440\u0430\u0437 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 CAP_NET_RAW capability, \u0434\u0430 \u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u0442\u0435\u043c\u0443 \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0445 (\u0442\u0443\u0442 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0438\u0445 \u0441\u043f\u0438\u0441\u043e\u043a) \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 capabilities. \u0422\u0430\u043a \u043a\u0430\u043a CAP_NET_RAW \u043f\u0440\u043e\u0441\u0442\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044f\u0440\u043a\u0438\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u043c \u0438\u0437 \u0442\u0435\u0445 \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0421 \u043d\u0435\u0439 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0446\u0435\u043b\u044b\u0439 \u0440\u044f\u0434 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c:\n- \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f CVE-2020-14386 \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c container escape \n- \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f MitM \u0430\u0442\u0430\u043a\n\n\n\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u044d\u0442\u043e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442, \u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0431\u0440\u0430\u0442\u044c \u0442\u0435 capabilities \u0447\u0442\u043e \u0435\u043c\u0443 \u043d\u0435 \u043d\u0443\u0436\u043d\u044b, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438.\n\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 securityContext \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 capabilities \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f add \u0438 drop. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440:\n\n\nsecurityContext:\n  capabilities:\n  drop:\n    - all\n  add:\n    - NED_BIND_SERVICE", "creation_timestamp": "2020-11-27T08:26:20.000000Z"}, {"uuid": "067c8755-5dfb-4b04-8fbe-107c2352c235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/k8security/116", "content": "\u0417\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043c\u0435\u0442\u043a\u0430 \"Impact of CVE-2020-14386 on Kubernetes and Containers (Docker)\" \u043b\u0438\u0448\u043d\u0438\u0439 \u0440\u0430\u0437 \u043d\u0435 \u0434\u0430\u0435\u0442 \u0437\u0430\u0431\u044b\u0442\u044c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0445\u043e\u0441\u0442\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 Kubernetes \u044d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u0447\u0430\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Kubernetes \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. \n\n\u0417\u0434\u0435\u0441\u044c \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Linux - CVE-2020-14386, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root'\u0430 \u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 Node, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0432\u043d\u0443\u0442\u0440\u0438 Pod'\u0430 \u0441 CAP_NET_RAW capability.\n\n\u0415\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u0430\u044f \u0438 \u043d\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u0435\u043b\u0430\u0442\u044c \"container escape\". \u0418 \u0432\u0441\u0435 \u044d\u0442\u043e \u043d\u0438\u043a\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u0438 \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0430\u043c\u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u0442\u044c, \u043d\u0435 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c.\n\n\u0427\u0442\u043e \u0432 \u0442\u0430\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0434\u0435\u043b\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b?\n1) \u041c\u043e\u0436\u043d\u043e/\u043d\u0443\u0436\u043d\u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u0442\u044c \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u0432\u0430\u0448\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0422\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e, \u0447\u0442\u043e \u0440\u0430\u043d\u0435\u0435 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0443 \u0432\u0430\u0441 \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u043e. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0432\u0430\u043c \u043b\u043e\u0432\u0438\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \"container escape\", \u043d\u043e \u0438 \u0434\u0440\u0443\u0433\u0443. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 (Lateral Movement, \u0437\u0430\u043f\u0443\u0441\u043a \u043c\u0430\u043d\u0435\u0439\u0440\u043e\u0432 \u0438 \u0442.\u0434.)\n2) \u041c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c\u0441\u044f \u043a \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c/\u0443\u0441\u0438\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u043c Low-level Runtime (OCI Runtimes) \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0433\u043e\u0432\u043e\u0440\u0438\u043b\u0438 \u0440\u0430\u043d\u0435\u0435. \u041d\u043e \u0441\u0442\u043e\u0438\u0442 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c, \u0447\u0442\u043e \u043e\u043d\u0438, \u043a\u0430\u043a \u0438 \u043b\u044e\u0431\u043e\u0435 \u041f\u041e \u0441\u0430\u043c\u0438 \u043d\u0435 \u0437\u0430\u0441\u0442\u0440\u0430\u0445\u043e\u0432\u0430\u043d\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0430 \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u043e \u0443\u043c\u0435\u043d\u044c\u0448\u0430\u044e\u0442 \u0438 \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0442 attack surface. \u0422\u0430\u043a GKE Sandbox \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e gVisor.", "creation_timestamp": "2020-09-23T07:49:11.000000Z"}, {"uuid": "4a9d0ddd-8f3f-4ecd-9b59-107dcbac9ff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/sec_devops/317", "content": "\u0417\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043c\u0435\u0442\u043a\u0430 \"Impact of CVE-2020-14386 on Kubernetes and Containers (Docker)\" \u043b\u0438\u0448\u043d\u0438\u0439 \u0440\u0430\u0437 \u043d\u0435 \u0434\u0430\u0435\u0442 \u0437\u0430\u0431\u044b\u0442\u044c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0445\u043e\u0441\u0442\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 Kubernetes \u044d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u0447\u0430\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Kubernetes \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. \n\n\u0417\u0434\u0435\u0441\u044c \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Linux - CVE-2020-14386, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root'\u0430 \u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 Node, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0432\u043d\u0443\u0442\u0440\u0438 Pod'\u0430 \u0441 CAP_NET_RAW capability.\n\n\u0415\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u0430\u044f \u0438 \u043d\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u0435\u043b\u0430\u0442\u044c \"container escape\". \u0418 \u0432\u0441\u0435 \u044d\u0442\u043e \u043d\u0438\u043a\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u0438 \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0430\u043c\u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u0442\u044c, \u043d\u0435 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c.\n\n\u0427\u0442\u043e \u0432 \u0442\u0430\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0434\u0435\u043b\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b?\n1) \u041c\u043e\u0436\u043d\u043e/\u043d\u0443\u0436\u043d\u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u0442\u044c \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u0432\u0430\u0448\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0422\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e, \u0447\u0442\u043e \u0440\u0430\u043d\u0435\u0435 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0443 \u0432\u0430\u0441 \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u043e. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0432\u0430\u043c \u043b\u043e\u0432\u0438\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \"container escape\", \u043d\u043e \u0438 \u0434\u0440\u0443\u0433\u0443. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 (Lateral Movement, \u0437\u0430\u043f\u0443\u0441\u043a \u043c\u0430\u043d\u0435\u0439\u0440\u043e\u0432 \u0438 \u0442.\u0434.)\n2) \u041c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c\u0441\u044f \u043a \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c/\u0443\u0441\u0438\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u043c Low-level Runtime (OCI Runtimes) \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0433\u043e\u0432\u043e\u0440\u0438\u043b\u0438 \u0440\u0430\u043d\u0435\u0435. \u041d\u043e \u0441\u0442\u043e\u0438\u0442 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c, \u0447\u0442\u043e \u043e\u043d\u0438, \u043a\u0430\u043a \u0438 \u043b\u044e\u0431\u043e\u0435 \u041f\u041e \u0441\u0430\u043c\u0438 \u043d\u0435 \u0437\u0430\u0441\u0442\u0440\u0430\u0445\u043e\u0432\u0430\u043d\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0430 \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u043e \u0443\u043c\u0435\u043d\u044c\u0448\u0430\u044e\u0442 \u0438 \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0442 attack surface. \u0422\u0430\u043a GKE Sandbox \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e gVisor.", "creation_timestamp": "2020-09-23T11:27:40.000000Z"}, {"uuid": "39478313-178b-4d27-8ddf-afe1ed7bad78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/arpsyndicate/281", "content": "#ExploitObserverAlert\n\nCVE-2020-14386\n\nDESCRIPTION: Exploit Observer has 30 entries related to CVE-2020-14386. A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.\n\nFIRST-EPSS: 0.000450000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-11-19T16:07:42.000000Z"}, {"uuid": "dbf0e8cc-c84f-4b15-a927-913ecb2acd65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1798", "content": "CVE-2020-14386:\nLinux kernel af_packet.c/\"container escape\"-vulnerability (PoC)\nhttps://www.openwall.com/lists/oss-security/2020/09/03/3\n]-> Impact of CVE-2020-14386 on Kubernetes and Containers (Docker)\nhttps://www.linkedin.com/pulse/cve-2020-14386-kubernetes-riyaz-ahemed-walikar/", "creation_timestamp": "2020-09-23T22:36:33.000000Z"}, {"uuid": "760b1f6d-302e-47c5-81e9-aee3502bb20a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/devsecops_weekly/67", "content": "\u0418 \u044d\u0442\u043e \u0441\u043d\u043e\u0432\u0430 \u043c\u044b!\n\n\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u043f\u043e\u0441\u0442\u0435 \u043c\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u0440\u043e \u0437\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0430 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432: \u043d\u0430 \u00ab\u0443\u0440\u043e\u0432\u043d\u0435\u00bb \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0438 runtime. \u0410 \u0442\u0430\u043a \u043b\u0438 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435?\n\n\u041e\u0442\u0432\u0435\u0442 \u2013 \u0434\u0430. \u0418\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-14386, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root \u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c escape \u043d\u0430 node.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Sysdig \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u043e\u0442\u0440\u044f\u0441\u0430\u044e\u0449\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432:\n\n\ud83c\udf6d Falco (runtime \u0437\u0430\u0449\u0438\u0442\u0430) \u2013 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 socket \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\n\ud83c\udf6d Sysdig Secure \u2013 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 workloads \u0441 \u0446\u0435\u043b\u044c\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0442\u0435\u0445, \u0447\u0442\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u043e\u0439 CVE\n\n\u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:\n\n\ud83c\udf6d \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443\n\ud83c\udf6d \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c CAP_NET_RAW\n\ud83c\udf6d \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PodSecurityPolicy\n\n\u0414\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043f\u043e\u0434\u043e\u0439\u0434\u0435\u0442 Sysdig Secure PSP Advisor, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u00ab\u044d\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u00bb \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0434\u043b\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 workloads, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u044d\u0444\u0444\u0435\u043a\u0442 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438) \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a!\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435: https://sysdig.com/blog/cve-2020-14386-falco/", "creation_timestamp": "2026-08-04T12:00:08.219483Z"}, {"uuid": "c252793a-cce6-4b35-a5ac-ef36a9b4b8ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/devsecops_weekly/67", "content": "\u0418 \u044d\u0442\u043e \u0441\u043d\u043e\u0432\u0430 \u043c\u044b!\n\n\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u043f\u043e\u0441\u0442\u0435 \u043c\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u0440\u043e \u0437\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0430 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432: \u043d\u0430 \u00ab\u0443\u0440\u043e\u0432\u043d\u0435\u00bb \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0438 runtime. \u0410 \u0442\u0430\u043a \u043b\u0438 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435?\n\n\u041e\u0442\u0432\u0435\u0442 \u2013 \u0434\u0430. \u0418\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-14386, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root \u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c escape \u043d\u0430 node.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Sysdig \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u043e\u0442\u0440\u044f\u0441\u0430\u044e\u0449\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432:\n\n\ud83c\udf6d Falco (runtime \u0437\u0430\u0449\u0438\u0442\u0430) \u2013 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 socket \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\n\ud83c\udf6d Sysdig Secure \u2013 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 workloads \u0441 \u0446\u0435\u043b\u044c\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0442\u0435\u0445, \u0447\u0442\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u043e\u0439 CVE\n\n\u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:\n\n\ud83c\udf6d \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443\n\ud83c\udf6d \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c CAP_NET_RAW\n\ud83c\udf6d \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PodSecurityPolicy\n\n\u0414\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043f\u043e\u0434\u043e\u0439\u0434\u0435\u0442 Sysdig Secure PSP Advisor, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u00ab\u044d\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u00bb \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0434\u043b\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 workloads, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u044d\u0444\u0444\u0435\u043a\u0442 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438) \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a!\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435: https://sysdig.com/blog/cve-2020-14386-falco/", "creation_timestamp": "2026-08-05T00:00:44.255936Z"}, {"uuid": "68022c44-5c17-45b5-9b62-31f3cec168d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "published-proof-of-concept", "source": "https://t.me/devsecops_weekly/67", "content": "\u0418 \u044d\u0442\u043e \u0441\u043d\u043e\u0432\u0430 \u043c\u044b!\n\n\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c \u043f\u043e\u0441\u0442\u0435 \u043c\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u0440\u043e \u0437\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0430 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432: \u043d\u0430 \u00ab\u0443\u0440\u043e\u0432\u043d\u0435\u00bb \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0438 runtime. \u0410 \u0442\u0430\u043a \u043b\u0438 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435?\n\n\u041e\u0442\u0432\u0435\u0442 \u2013 \u0434\u0430. \u0418\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-14386, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root \u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c escape \u043d\u0430 node.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Sysdig \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u043e\u0442\u0440\u044f\u0441\u0430\u044e\u0449\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432:\n\n\ud83c\udf6d Falco (runtime \u0437\u0430\u0449\u0438\u0442\u0430) \u2013 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 socket \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\n\ud83c\udf6d Sysdig Secure \u2013 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 workloads \u0441 \u0446\u0435\u043b\u044c\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0442\u0435\u0445, \u0447\u0442\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u043e\u0439 CVE\n\n\u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:\n\n\ud83c\udf6d \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443\n\ud83c\udf6d \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c CAP_NET_RAW\n\ud83c\udf6d \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PodSecurityPolicy\n\n\u0414\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043f\u043e\u0434\u043e\u0439\u0434\u0435\u0442 Sysdig Secure PSP Advisor, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u00ab\u044d\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u00bb \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0434\u043b\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 workloads, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u044d\u0444\u0444\u0435\u043a\u0442 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438) \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a!\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435: https://sysdig.com/blog/cve-2020-14386-falco/", "creation_timestamp": "2026-08-06T00:00:36.816541Z"}, {"uuid": "166a2eae-53d4-49cf-a82a-fba11e2ad1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/cissp/1398", "content": "Impact of CVE-2020-14386 on Kubernetes and Containers (Docker):\n\ud83d\udc4d\ud83c\udffd\u270c\ud83c\udffc\ud83d\ude00\nAn interesting vulnerability affecting the Linux kernel was disclosed earlier this month, CVE-2020-14386. Essentially, a memory corruption issue in net/packet/af_packet.c that can be exploited to overwrite up to 10 bytes of memory and potentially gain root privileges from unprivileged processes.\nThe full disclosure post is at https://www.openwall.com/lists/oss-security/2020/09/03/3\nThe primary requirement for potential exploitation for this is that the target system needs to have the CAP_NET_RAW capability enabled.\u00a0\nWhen we look at this issue from a Kubernetes or general container point of view, the issue could allow an attacker within a container to escape and access the underlying node. Imagine a scenario where an attacker has gained access to a pod by exploiting a vulnerability in a service that is exposed. A web application with SQL Injection perhaps? Or a file upload feature that can be abused? In any case, an attacker-in-a-pod is a very real threat owing to how web applications are written and services can potentially be configured.\nAn attacker would be able to abuse the extended capabilities to generate a spoofed packet with incorrect values within the packet and cause an out of bounds write of user controlled data. This can be used to execute user controlled code to possibly escape the container and obtain root privileges on the host node. This is rated as a High severity vulnerability.\nIf you are on GKE, Google has issued a security bulletin, GCP-2020-012, describing the mitigations that need to be applied - https://cloud.google.com/kubernetes-engine/docs/security-bulletins#gcp-2020-012\nTo detect if your cluster is vulnerable, you can enumerate privileges within the pods using capsh, pscap or getcap from the libcap2-bin, libcap-ng-utils or libcap-progs packages respectively. The command would be run using kubectl or via a shell within the pod. For example -\nkubectl exec podname --capsh --print\nIf we look closely at the Threat Matrix for Kubernetes - , the Execution tactic aligns with how an attacker would be able to reach and gain execution within a pod. Prevalence of vulnerabilities like CVE-2020-14386 allow for an attacker within a pod to attempt lateral privilege escalation to escape out of the container (Privilege escalation tactic). Once an attacker has gained access to a node, based on the RBAC and namespaces configured, the attacker would be able to list K8S secrets, access application credentials in configuration files, identify additional nodes to attack, gain access to and abuse internal networking, hijack resources to perform cryptomining (popular lately) or perform denial of service attacks.\nIssues like these make the container world exciting for attackers as post exploitation scenarios vary drastically then when attacking say an individual standalone box.", "creation_timestamp": "2026-09-01T17:01:12.809687Z"}, {"uuid": "2cc7f862-f72a-4140-9860-dd14458045d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/hacking_Attack/11444", "content": "container_escape  7.8 (https://nvd.nist.gov/vuln/detail/CVE-2016-5195)  \u2705      cve-2018-18955 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2018-18955.yaml)  kernel  privilege_escalation  7.0 (https://nvd.nist.gov/vuln/detail/CVE-2018-18955)  \u2705      cve-2020-14386 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2020-14386.yaml)  kernel  container_escape  7.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-14386)  \u2705      cap_dac_read_search-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/cap_dac_read_search-container.yaml)  config  container_escape  -  \u2705      cap_sys_admin-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/cap_sys_admin-container.yaml)  config  container_escape  -  \u2705      cap_sys_ptrace-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/cap_sys_ptrace-container.yaml)  config  container_escape  -  \u2705      privileged-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/privileged-container.yaml)  config  container_escape  -  \u2705      mount-docker-sock (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/mounts/mount-docker-sock.yaml)  mount  container_escape  -  \u2705      mount-host-etc (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/mounts/mount-host-etc.yaml)  mount  container_escape  -  \u2705      mount-host-procfs (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/mounts/mount-host-procfs.yaml)  mount  container_escape  -  \u2705      kata-escape-2020 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kata-containers/kata-escape-2020.yaml)  kata-containers  container_escape  6.3 (https://nvd.nist.gov/vuln/detail/CVE-2020-2023)/8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-2025)/8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-2026)  \u2705      \n4.2 Vulnerable Scenes Related to Cloud Native Applications\n  These scenes are mainly derived from other open-source projects:    Vulhub (https://github.com/vulhub/vulhub)  DVWA (https://github.com/digininja/DVWA)    We express sincere gratitude to projects above!  Metarget converts scenes in projects above to Deployments and Services resources in Kubernetes (thanks to kompose (https://github.com/kubernetes/kompose)).  To list vulnerable scenes related to cloud native applications supported by Metarget, just run\uff1a  ./metarget appv list  \n5 DEMO", "creation_timestamp": "2026-09-01T20:02:38.510356Z"}, {"uuid": "e4870535-5c74-472c-9b66-d4911d22033a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/hacking_Attack/11444", "content": "container_escape  7.8 (https://nvd.nist.gov/vuln/detail/CVE-2016-5195)  \u2705      cve-2018-18955 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2018-18955.yaml)  kernel  privilege_escalation  7.0 (https://nvd.nist.gov/vuln/detail/CVE-2018-18955)  \u2705      cve-2020-14386 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2020-14386.yaml)  kernel  container_escape  7.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-14386)  \u2705      cap_dac_read_search-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/cap_dac_read_search-container.yaml)  config  container_escape  -  \u2705      cap_sys_admin-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/cap_sys_admin-container.yaml)  config  container_escape  -  \u2705      cap_sys_ptrace-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/cap_sys_ptrace-container.yaml)  config  container_escape  -  \u2705      privileged-container (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/configs/privileged-container.yaml)  config  container_escape  -  \u2705      mount-docker-sock (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/mounts/mount-docker-sock.yaml)  mount  container_escape  -  \u2705      mount-host-etc (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/mounts/mount-host-etc.yaml)  mount  container_escape  -  \u2705      mount-host-procfs (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/mounts/mount-host-procfs.yaml)  mount  container_escape  -  \u2705      kata-escape-2020 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kata-containers/kata-escape-2020.yaml)  kata-containers  container_escape  6.3 (https://nvd.nist.gov/vuln/detail/CVE-2020-2023)/8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-2025)/8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-2026)  \u2705      \n4.2 Vulnerable Scenes Related to Cloud Native Applications\n  These scenes are mainly derived from other open-source projects:    Vulhub (https://github.com/vulhub/vulhub)  DVWA (https://github.com/digininja/DVWA)    We express sincere gratitude to projects above!  Metarget converts scenes in projects above to Deployments and Services resources in Kubernetes (thanks to kompose (https://github.com/kubernetes/kompose)).  To list vulnerable scenes related to cloud native applications supported by Metarget, just run\uff1a  ./metarget appv list  \n5 DEMO", "creation_timestamp": "2026-09-02T01:03:14.201766Z"}, {"uuid": "e3183518-6039-45bb-bf00-2da4c6341113", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14386", "type": "seen", "source": "https://t.me/cissp/1398", "content": "Impact of CVE-2020-14386 on Kubernetes and Containers (Docker):\n\ud83d\udc4d\ud83c\udffd\u270c\ud83c\udffc\ud83d\ude00\nAn interesting vulnerability affecting the Linux kernel was disclosed earlier this month, CVE-2020-14386. Essentially, a memory corruption issue in net/packet/af_packet.c that can be exploited to overwrite up to 10 bytes of memory and potentially gain root privileges from unprivileged processes.\nThe full disclosure post is at https://www.openwall.com/lists/oss-security/2020/09/03/3\nThe primary requirement for potential exploitation for this is that the target system needs to have the CAP_NET_RAW capability enabled.\u00a0\nWhen we look at this issue from a Kubernetes or general container point of view, the issue could allow an attacker within a container to escape and access the underlying node. Imagine a scenario where an attacker has gained access to a pod by exploiting a vulnerability in a service that is exposed. A web application with SQL Injection perhaps? Or a file upload feature that can be abused? In any case, an attacker-in-a-pod is a very real threat owing to how web applications are written and services can potentially be configured.\nAn attacker would be able to abuse the extended capabilities to generate a spoofed packet with incorrect values within the packet and cause an out of bounds write of user controlled data. This can be used to execute user controlled code to possibly escape the container and obtain root privileges on the host node. This is rated as a High severity vulnerability.\nIf you are on GKE, Google has issued a security bulletin, GCP-2020-012, describing the mitigations that need to be applied - https://cloud.google.com/kubernetes-engine/docs/security-bulletins#gcp-2020-012\nTo detect if your cluster is vulnerable, you can enumerate privileges within the pods using capsh, pscap or getcap from the libcap2-bin, libcap-ng-utils or libcap-progs packages respectively. The command would be run using kubectl or via a shell within the pod. For example -\nkubectl exec podname --capsh --print\nIf we look closely at the Threat Matrix for Kubernetes - , the Execution tactic aligns with how an attacker would be able to reach and gain execution within a pod. Prevalence of vulnerabilities like CVE-2020-14386 allow for an attacker within a pod to attempt lateral privilege escalation to escape out of the container (Privilege escalation tactic). Once an attacker has gained access to a node, based on the RBAC and namespaces configured, the attacker would be able to list K8S secrets, access application credentials in configuration files, identify additional nodes to attack, gain access to and abuse internal networking, hijack resources to perform cryptomining (popular lately) or perform denial of service attacks.\nIssues like these make the container world exciting for attackers as post exploitation scenarios vary drastically then when attacking say an individual standalone box.", "creation_timestamp": "2026-09-02T01:05:02.980971Z"}]}