Elastic medium stable eql

Potential Container Escape via Kernel core_pattern Modification

The Linux kernel invokes the program named in "/proc/sys/kernel/core_pattern" whenever a process core-dumps. When that value begins with a pipe (|), the kernel runs the handler from the host's initial namespace as root, regardless of where the crashing process lived. Because the core-dump up-call is not namespaced, a process inside a container that can write core_pattern can register an attacker-controlled handler and then deliberately crash a process to have it execute on the host as root, resulting in a full container-to-host escape.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.args like ("*/proc/sys/kernel/core_pattern*", "*kernel.core_pattern*") and
?process.parent.executable != null and
(
  process.name in ("tee", "cp", "mv", "dd") or
  (
    process.name == "sysctl" and
    process.args like ("*-w*", "*core_pattern*")
  ) or
  (
    process.name in ("bash", "dash", "sh", "zsh", "ksh", "fish", "ash", "mksh", "busybox") and
    process.args == "-c" and process.args like ("*echo *", "*printf *")
  )
) and
not ?process.parent.executable in ("/usr/lib/systemd/systemd", "/usr/bin/kdumpctl", "/usr/sbin/abrtd", "/usr/bin/apport")

Field Validations

Loading…

Comments (0)

Loading comments...