Kernel privilege escalation

This post examines how Kubernetes container isolation interacts with kernel privilege escalation by demonstrating an exploit (CVE-2017-7308) both on a VM and inside a pod. The author shows how capabilities, unprivileged user namespaces, and namespace manipulation can enable container-to-host privilege escalation, and explains mitigations — notably seccomp profiles, capability management, and the importance of patching — to reduce the attack surface.