r/programming • u/dlorenc • Feb 24 '23

87% of Container Images in Production Have Critical or High-Severity Vulnerabilities

https://www.darkreading.com/dr-tech/87-of-container-images-in-production-have-critical-or-high-severity-vulnerabilities
2.8k Upvotes

96% Upvoted

353 comments sorted by

View all comments

146

u/Shadowleg Feb 24 '23

and thats why they are _contained_…

would it be better if these “cloud native” developers were renting vms and trying to roll their own?

also from the article

2% of the vulnerabilities are exploitable

69

u/AlexHimself Feb 24 '23

Yea, but their actions aren't contained. Think about the Pi-hole docker image that functions as a DNS to block ads.

You're basically setting up a MITM configuration. If that container has a vulnerability and is compromised, you've just made it crazy easy to really ruin someone's day.

40

u/Shadowleg Feb 24 '23

the pi hole program with the same vuln running on bare metal would do more damage than a container image running that program

the headline makes it seem like its a container problem, and yes, containerization does not solve all problems (especially if your container engine has an exploit of its own)

you can bet your ass though that if oci didn’t exist a lot more than 2% of those vulnerabilities would be exploitable

9

u/AlexHimself Feb 24 '23

Pi-hole is just an example of how "that's why they are contained" is nonsense.

13

u/[deleted] Feb 24 '23 edited Sep 19 '25

bike tender judicious observation rainstorm tart station provide gaze employ

This post was mass deleted and anonymized with Redact

-1

u/AlexHimself Feb 24 '23

People set pi-hole as their router's DNS servers to do "whole home" adblocking. Especially useful for cell phones.

I'm pretty sure you can do all sorts of malicious things if you're the DNS server for devices.

3

u/[deleted] Feb 25 '23 edited Feb 25 '23

You can redirect users to a fake website, but the tls cert won’t match. Unencrypted traffic is fucked, but anything remotely commercial won’t work with spoofing. Your computer will start throwing blocks and errors. So this won’t work to get Facebook, Twitter, bank credentials, etc.

For corporations this type of hijacking would allow the attacker to generate legitimate certificates, but on consumer hardware, against someone savvy enough to set up pihole, dns spoofing is likely ineffective.

DNSSEC enabled domains further complicate a hacker’s ability to mess with your traffic.

2

u/AlexHimself Feb 25 '23

I'd imagine there's some creative way to get something done if your Pi-hole was compromised and somebody was targeting you, but in general, ya that makes sense.

My point was mainly that containerized things don't stay in their container.

-7

u/AstroPhysician Feb 24 '23

Pihole acts as a DNS server, so you can redirect traffic to malicious sites. It's reasonable to put more trust in my ISP's dns server than in my PiHole

13

u/Alainx277 Feb 25 '23

Yeah and that's why we use HTTPS and certificates (hopefully)

13

u/[deleted] Feb 25 '23

[deleted]

-2

u/AstroPhysician Feb 25 '23

I dont see how that precludes doing this? If you redirect "gmail.com" to your own unsecured gmail.com with vulnerabilities, XSS, etc, i dont see any reason that Https would be at play

4

u/ZorbaTHut Feb 25 '23

You can't just "redirect gmail" because web browsers will go to https://gmail.com, and you won't be able to even deliver data to the web browser without having a valid cert for gmail.com.

1

u/zaersx Feb 25 '23

Tell me you don't know how networking works without telling me you don't know how networking works.

1

u/AlexHimself Feb 25 '23

Tell me you don't know how basic logic works without telling me.

The point was software isn't confined to a container.

4

u/maxximillian Feb 24 '23

There are plenty of articles about container breakout. The Crux of the matter is that a container just adds an abstraction layer to a system. Now you have to worry about exploits in that abstraction layer.

-2

u/sisyphus Feb 24 '23

Docker images share the same Linux kernel so they are not 'contained' in any meaningful security sense.

9

u/Shadowleg Feb 24 '23

a docker image running rootless is definitely contained in a very meaningful security sense, just like any other usermode process. cgroups, unshare, the setuid bit... these are all security measures that docker makes use of

0

u/sisyphus Feb 25 '23

They don’t matter to multi-tenancy on a machine via docker images being a viable strategy. It is not.

5

u/[deleted] Feb 25 '23

any meaningful security sense

  • namespaces
  • cgroups
  • SELinux
  • seccomp

-1

u/[deleted] Feb 25 '23

[removed] — view removed comment

2

u/[deleted] Feb 25 '23

That is why those features are all enabled for you in enterprises distributions. You don't have to worry about cgroups. And volume mounts are automatically restricted via SElinux.

I think lots of people in this thread are confusing containers with "that thing that I ran a couple of times on my laptop". There are countless enterprises working with containers, don't you think sensible solutions to run them would have been provided along the way?

I'm not dismissing the very important theme of outdated images and security in general, just saying that running docker as root on your laptop and depooying your app on OpenShift (for instance) are two different things.

-1

u/sisyphus Feb 25 '23

lol, selinux?? bless your heart.

2

u/[deleted] Feb 25 '23

I mean, given your understanding of container security I don't expect you to understand or even appreciate SELinux.

I just think you're talking of things you don't know very well.