this post was submitted on 27 Jul 2025
171 points (96.7% liked)
Technology
73379 readers
4683 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
$10 says they haven't actually escaped anything and it's just hallucinating a directory structure & file contents
MS said they fixed it and categorised it as a "moderate severity vulnerability" so presumably they did in fact gain root access to the container
If they gained root access to the container, that's not a moderate vulnerability. Root inside a container is still root. You can still access the kernel with root privs and it's the same kernel as the host.
Docker is not a virtual machine.
Docker isn’t, but I was under the impression that hyperscalars tended to put all their containers in lightweight VMs or use something like kata containers anyways for security purposes
I know that? I'm just saying that MS categorised it as such. It would be strange to include the part about MS's responses if MS also found that the vulnerability was not what the researchers claimed it was.
What I'm saying is something about the story doesn't add up.
Either Microsoft classified a major issue as a minor one so they didn't have to payout the bug bounty (quite possible), or the attack didn't achieve what the researchers thought it did and Microsoft classified it according to it's actual results.
If I have to choose between either ms or an unknown being correct, I pick the unknown person.
That assumes the container itself is run as root, right?
I think they gained root to the python env which they couldn't do anything with because it was still running in docker inside a VM.
Even if it had access to its own source during training, the chances of it regurgitating it with total fidelity are zero.