{"uuid": "8489fbea-23c3-4d9c-8b4a-ce4f9892deff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-13401", "type": "seen", "source": "https://gist.github.com/ritvikos/7997cdd8ba93849445b59e95680225a3", "content": "we've got a process to sandbox/isolate, passed in via cli-args [which is basically\n`task_struct` [0] from kernel's standpoint. now, the kernel's virtual-layer [1]\ndetermines what a process sees in its env (resources: pid, hostname, mounts, time,\netc); internally, it basically derefs the namespace-proxy [2] to do so; by \nre-assigning those pointers target proc gets its own view of each resource.\nhow do we actually do that from userspace? via namespaces [3].\n\nok, so we've fixed what the proc interacts with (or atleast what we think); \nnow comes the privileges; within the kernel, it's determined by `struct cred` [4] via \nreal-uid, euid, saved-setuid; there're two proc's privilege-level in unix: \nprivileged (euid=0) & unprivileged (euid!=0) (see my poorly-written notes [5])\n\nbut; linux-kernel allots finer control, by splitting the privileges into capabilities [6],\nwhich control what our process can access - privileged ports (<1024), sys-admin ops\nlike mounts, pivot_root (change proc's root-mount), etc. if we don't limit the proc's\ncaps or mistakenly miss, malicious proc can perform privileged-ops and escape the \nenv we curated for it [7].\n\ntool itself basically (on a high-level) setups the namespaces; \nspawns the child proc - parent supervises it via ipc till exec completes; \nbuilds private rootfs; handle mounts; isolate net, cleanup and pass return child's \nexit-state to the parent - all while handling privileges in each phase.\n\n[0]: https://elixir.bootlin.com/linux/v7.1.7/source/include/linux/sched.h#L820\n[1]: https://makelinux.github.io/kernel/map/ (see virtual-layer)\n[2]: https://elixir.bootlin.com/linux/v7.1.7/source/include/linux/nsproxy.h#L32\n[3]: https://www.mankier.com/7/namespaces\n[4]: https://elixir.bootlin.com/linux/v7.1.7/source/include/linux/cred.h#L115\n[5]: https://any.coop/A5kN6zx2wYDYesyJtq5ZdU47CgeRr2fMgJ8mPCxZ3XGBqXJS/privilege-model\n[6]: https://www.mankier.com/7/capabilities\n[7]: https://www.cve.org/CVERecord?id=CVE-2020-13401", "creation_timestamp": "2026-08-10T23:56:42.288073Z"}