Comment on How we Rooted Copilot

• wewbull@feddit.uk ⁨4⁩ ⁨weeks⁩ ago

  If they gained root access to the container, that’s not a moderate vulnerability. Root inside a container is still root. You can still access the kernel with root privs and it’s the same kernel as the host.

  Docker is not a virtual machine.

  source

  • communism@lemmy.ml ⁨4⁩ ⁨weeks⁩ ago

    I know that? I’m just saying that MS categorised it as such. It would be strange to include the part about MS’s responses if MS also found that the vulnerability was not what the researchers claimed it was.

    source

    • wewbull@feddit.uk ⁨4⁩ ⁨weeks⁩ ago

      What I’m saying is something about the story doesn’t add up.

      Either Microsoft classified a major issue as a minor one so they didn’t have to payout the bug bounty (quite possible), or the attack didn’t achieve what the researchers thought it did and Microsoft classified it according to it’s actual results.

      source

      • trolololol@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

        If I have to choose between either ms or an unknown being correct, I pick the unknown person.

        source
  • Grappling7155@lemmy.ca ⁨4⁩ ⁨weeks⁩ ago

    Docker isn’t, but I was under the impression that hyperscalars tended to put all their containers in lightweight VMs (like kata containers) anyways for security purposes

    source
  • ftbd@feddit.org ⁨4⁩ ⁨weeks⁩ ago

    That assumes the container itself is run as root, right?

    source
  • Fizz@lemmy.nz ⁨4⁩ ⁨weeks⁩ ago

    I think they gained root to the python env which they couldn’t do anything with because it was still running in docker inside a VM.

    • According to a smart sounding fella on hacker news.

    source