Hacker News Reader

Comment by arcfour | Hacker News Reader

Are they already vulnerable to RCE as an unprivileged user? Hopefully not.

An LPE only allows an attacker who can already execute code on the system to become root. So, bad, yes, but it doesn't mean you are immediately pwned.

View on HN

Should I rush to Lambda or ECS and turn off all my containers sharing a host with who the hell knows?

Like others have said, this will get you root inside the container. It isn't a container escape. File/volume mounts shared across containers would be vulnerable.

Firecracker is extremely hardened, so I wouldn't worry about Lambda. As for ECS, getting root doesn't necessarily mean you have a container escape. I think you could escape containers with this exploit, but you would need a different payload than what's published. I could be wrong though.

I would assume AWS is pretty on the ball when it comes to handling stuff like this if they didn't have other defenses or mitigations in place already.

AFAIK Lambda and everything else will use micro-VMs. No serious company would use a shared kernel design for workloads in different security contexts. (Personally I wouldn't even use the same hardware host, but sometimes sacrifices have to be made)

And for a single user desktop, an LPE is almost meaningless as all the really important files are in $HOME and accessible without root.

Perhaps, unless you want persistence.

Reply on news.ycombinator.com