container security

container security

gVisor's VFS use-after-free: the fix shipped five weeks before the CVE

A use-after-free in gVisor's VFS layer let a container-privileged attacker double-free a backing MemoryFile and reach code execution in the host sentry process. The fix shipped in a routine release on September 4; the CVE did not publish until October 9.