Container escape
Escape via privileged mode, docker.sock, bind mounts or kernel bugs
categoryCloud, container and supply chain attacksseverityVery HighdetectabilityHighlabnot yet measured
Example: Siloscape
Classification
25 values: 6 reviewed, 16 imported, 3 derived. What do these mean?
Exploitability
| Attack vector | Software vulnerabilities |
|---|---|
| Attacker skill required | High |
| Resources required | Low |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | Very High |
|---|---|
| Platform | ContainersESXiLinuxWindows |
| Environment | CloudOn-premises |
| Target asset class | Server |
| Kill-chain phase (tactic) | Privilege Escalation |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Container CreationFile CreationKernel Module LoadOS API ExecutionProcess CreationVolume Modification |
| Attack permissions (ATT&CK) | AdministratorrootUser |
Detection & response
Mitigated by 5
- M1026 attack-mitigation
- M1038 attack-mitigation
- M1042 attack-mitigation
- M1048 attack-mitigation
- M1051 attack-mitigation
Detected by 3
- DET0219 attack-detection-strategy
402b955c-8fe0-4a8c-b635-622b4ac5f902sigmac5cd1b20-36bb-488d-8c05-486be3d0cb97sigma
Tested by 3
0b2f9520-a17a-4671-9dba-3bd034099fffatomic39fab1bc-fcb9-406f-bc2e-fe03e42ff0e4atomic6c499943-b098-4bc6-8d38-0956fc182984atomic
Framework references
- Primary source: https://attack.mitre.org/techniques/T1611/
- attack: T1611 (primary)
- cve: CVE-2022-0185
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cloud, container and supply chain attacks' table, line 406 of Cyber-Attack-Taxonomy.md
- ev-0002 (CISA Known Exploited Vulnerabilities Catalog) — CISA KEV lists CVE-2022-0185 as known-exploited (kev=1, ransomware=unknown); added 2024-08-21.
Linux Kernel Heap-Based Buffer Overflow Vulnerability
- ev-0003 (FIRST EPSS scores) — FIRST EPSS for CVE-2022-0185: epss=0.25151 percentile=0.97831 (score date 2026-09-18).
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 5 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0005 (NVD CVE API 2.0) — NVD maps CVE-2022-0185 to weakness(es) CWE-190, CWE-191.
- ev-0006 (NVD CVE API 2.0) — Example vulnerability CVE-2022-0185: NVD CVSS v3.1 base 8.4 (HIGH) [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H]. Not applied as facets: CVSS scores this one vulnerability, not the attack class.