A docker security issue about persudo-terminals to make DoS attack in the Azure AKS environment.

Nanzi Yang 1 Reputation point
2021-05-03T14:01:39.87+00:00

We find a docker security issue to exhaust unprivilege user’s persudo-terminals in Linux Kernel and causing DoS attack in the Azure AKS environment.
Reproduction steps:
1.Follow the AKS tutorial to set up AKS clusters. We use one Virtual Machine with 8G memory, 120G SSD Disk, linux 5.4.0-1043-azure OS, Kubernetes Version V1.18.14 and Docker Version 19.3.14, to set the Azure Kubernetes Cluster. All those settings are done through by Azure Kubernetes UI.
2.Deploy the docker unprivileged malicious container with UID 1000, dropping all capabilities, using limited memory 2G, running on special core and disable privilege escalation. We run malicious container in a separate Kubernetes Namespace.
3.Inside the malicious container, we start four processes and make syscall open(/dev/ptmx) repeatedly. In total, around 3072 number of persudo-terminals are consumed and there are no available persudo-termainals can be used by other unprivilege user.
Is there any way to defend against this attack inside Azure AKS environment? Looking forward to your reply!

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,852 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nanzi Yang 1 Reputation point
    2021-06-02T03:13:16.387+00:00

    @KarishmaTiwari-MSFT Hello Karishmatiwari! I submitted my concern about the Azure AKS environment about two months ago, is there any new developments on this issue? Is it a real issue that exists in the Azure AKS environment? Looking forward to your reply!

    0 comments
  2. Nanzi Yang 1 Reputation point
    2021-06-04T13:34:27.133+00:00

    @KarishmaTiwari-MSFT Hello Karishmatiwari! I have sent an email to Azure Community as you asked, but I have got no response. Have you received my email? Are there any new developments on these issues? Looking forward to your reply!

    0 comments