CVE-2020-15257: containerd-shim API reachable from a container sharing the host network namespace
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 5.2 (Medium). Fixed in containerd 1.3.9 / 1.4.3.
Source
Relevance to doos
containerd-shim listened on an abstract Unix domain socket and only checked the caller's effective UID (0), not which namespace it called from. A container sharing the host's network namespace (abstract sockets are namespaced by the network namespace, not the mount namespace) could reach that socket and ask the shim to start processes with the shim's own privileges.
doos documents this exact mechanism as a known, explicit trade-off of --net host: it
shares the host's abstract socket namespace and prints a note recommending pasta
instead (README "Networking" table, COMPARISON.md section 6). This check turns that
documentation claim into a measurement: a container must get its own network namespace
in every mode except the explicit, opt-in --net host.
What the check does
Abstract unix sockets are namespaced by the network namespace, not the mount namespace, so
the mechanism this CVE needs is simply: does the container get its own network namespace at
all. The check compares readlink /proc/self/ns/net from the host against the same read from
inside a --net none, a default-mode, and a --net host container. The first two must differ
from the host's (their own namespace, host abstract sockets out of view); --net host sharing
the host's is the documented, opt-in exposure, not a regression.
Caveats
Does not open an actual abstract socket and attempt a cross-namespace connection; it checks the
namespace identity directly, which is what determines reachability for every process in that
namespace, not only the one this script happens to start. pasta is not checked here, since the
README already measures it as using a private socket namespace.
Run: make test in this directory, or make -C audit test from the repo root.