Toward Efficient Fuzzing for Container Escape Vulnerability Detection

Abstract

In recent years, container technology has gained popularity due to its resource efficiency and suitability for cloud-native applications. However, containers, which share the OS kernel, are vulnerable to container escape attacks when isolation mechanisms fail. This can lead to unauthorized access and security breaches. Fuzzing, a technique that generates random inputs to uncover software vulnerabilities, faces challenges in identifying container escape vulnerabilities due to the vast kernel space and non-crashing vulnerabilities. Syzkaller, a Linux kernel fuzzer, is ineffective at targeting container-specific vulnerabilities, while existing tools like Torpedo and Paced either focus on other issues or lack kernel code coverage. To address these limitations, the authors propose a novel fuzzing framework that uses directed fuzzing to prioritize container-related kernel code, such as namespaces and cgroups. Additionally, the framework introduces a dedicated detector for non-crashing vulnerabilities like unauthorized file access. The initial goal is to detect mount namespace escapes by fuzzing code related to file descriptors and scanning container-accessible files. The framework is being implemented by extending Syzkaller, using Docker on Linux, and leveraging AFL for fuzzing. The first target for detection is CVE-2024-21626, followed by applying the approach to other namespaces such as PID, Network, and IPC.

Type
Publication
In 15th ACM SIGOPS Asia-Pacific Workshop on Systems