Windows Server Containers Are Broken
Daniel Prizmant demonstrates fundamental architectural security flaws in Windows Server Process-Isolated Containers, executing root container escapes.
Summary
The Architecture of Windows Server Containers
Unlike Linux containers that rely on cgroups and namespaces, Windows Server containers implement process isolation by partitioning the Windows NT kernel and object manager.
Auditing Windows Process-Isolated Containers
Daniel Prizmant analyzes the security boundary of Windows Server containers, evaluating whether process-isolated containers represent a secure multi-tenant boundary.
Discovering Multiple Kernel-Level Container Escapes
Prizmant demonstrates multiple novel container escape vectors—including named pipe impersonation, CSRSS memory corruption, and kernel object sharing—to break out to the host OS.
Recommendations for Secure Windows Containerization
The author advises cloud operators to mandate Hyper-V isolation (virtualized containers) for multi-tenant Windows workloads to prevent kernel-level host compromise.
Related talks
Main Stage·36 min
Aviv Sasson
Aviv Sasson details discovering FabricEscape, a severe vulnerability in Microsoft Service Fabric allowing unprivileged containers to seize full cluster admin rights.
Main Stage·39 min
Eran Segal
Eran Segal investigates Windows container isolation (Process Isolation & Hyper-V), demonstrating novel container escape techniques via Silo IPC mechanisms.
Main Stage·43 min
Aviv Sasson
Aviv Sasson presents the complete technical breakdown of FabricEscape (CVE-2022-30137), breaking out of Linux containers to seize full Azure Service Fabric cluster control.