Kubernetes Privilege Escalation via HostPID Namespace

The Kubernetes hostPID namespace configuration allows a pod to share the process ID space with the underlying host node. While this capability is sometimes utilized for legitimate diagnostic or monitoring tasks, it introduces a significant security risk when unauthorized or compromised pods are deployed with this flag. By gaining access to host processes, an attacker can enumerate running services, identify sensitive configuration files, or inject code into host processes. When this misconfiguration is combined with privileged container status or capabilities like ptrace, it enables an attacker to escape the container environment, enter the host init system (PID 1), and escalate privileges to root on the node. This threat vector is critical in multi-tenant or shared-responsibility cluster environments where workload isolation is paramount. Defenders must monitor Kubernetes API audit logs for the creation or modification of pods that include the 'hostPID: true' specification.

Attack Chain

1. Attacker gains initial access to the Kubernetes cluster via compromised service account credentials or a vulnerable web application.
2. Attacker prepares a malicious container image designed for host process interaction.
3. Attacker uses the Kubernetes API to create or patch a pod specification, setting 'hostPID' to true.
4. The Kubernetes scheduler successfully deploys the malicious pod on a worker node.
5. Attacker executes a shell within the container to gain access to the host's PID namespace.
6. Attacker leverages ptrace or other process manipulation techniques to interact with host-level processes (PID 1).
7. Attacker executes malicious commands as root on the host node, effectively escaping the container boundary.

Impact

Successful exploitation results in full host node compromise, allowing the attacker to access sensitive host files, modify system configurations, pivot to other nodes in the cluster, or exfiltrate data from all containers running on the affected node.

Recommendation

Prioritize auditing cluster configurations and implementing admission control policies to restrict the use of the hostPID namespace to only verified, necessary system workloads.

• Deploy the provided detection rule to monitor for unauthorized pods using hostPID.
• Audit Kubernetes API audit logs (logs-kubernetes.audit_logs-*) for any pod creation or update events where hostPID is enabled.
• Implement Kubernetes Pod Security Admission (PSA) policies to prevent the deployment of pods with hostPID enabled in production namespaces.
• Review and prune high-privilege service account permissions to prevent unauthorized pod creation.