Breaking Boundaries & Demystifying Kernel SU 4 Root Access In Azure Cloud Shell

Breaking Boundaries & Demystifying Kernel SU 4 Root Access In Azure Cloud Shell

Speakers: Wami, Researcher, Indian Institute of Science; Abhishek, Software Developer, Nokia

Conference: Nullcon

YouTube: https://www.youtube.com/watch?v=P80azJb95V8

Overview

This talk, titled "Colonel Conquest," presented by Wami and Abhishek, delves into the critical security implications of containerized environments, specifically within Microsoft's Azure Cloud Shell. The speakers meticulously detail two significant kernel vulnerabilities they discovered and exploited, which allowed them to bypass security boundaries and achieve full root access within an unprivileged Azure Cloud Shell session. Their research highlights the inherent challenges in securing multi-tenant cloud environments and underscores the fact that even sophisticated isolation mechanisms are not immune to well-crafted exploits.

The presentation is crucial for cloud security professionals, kernel developers, and anyone interested in container security or bug bounty programs. It not only exposes specific flaws in a major cloud provider's infrastructure but also provides a deep technical analysis of the underlying causes, demonstrating how improper reference counting in kernel modules can lead to severe privilege escalation. By successfully achieving root access and demonstrating techniques like Kernel Address Space Layout Randomization (KASLR) bypass and heap address leaking, Wami and Abhishek challenge the assumption that containers inherently provide a strong security boundary.

The talk ultimately serves as a powerful reminder that while cloud providers implement extensive security controls, the complexity of modern kernel and container technologies can still harbor critical vulnerabilities. It emphasizes the continuous need for rigorous security research, prompt patching, and a defensive posture that assumes the possibility of container escapes, even in environments designed for robust isolation.

Background

▶ Watch: Introduction, speakers, and talk agenda (0:00)

Azure Cloud Shell is an interactive, authenticated, and browser-accessible terminal designed to manage Azure resources. It offers a pre-configured environment, fully managed by Microsoft, allowing users to interact with their Azure subscriptions without setting up a local development environment. Key characteristics of Azure Cloud Shell include a 20-minute timeout for inactive sessions (after which the session is deleted, though persistent files are saved), and support for approximately 20 concurrent users per session. Crucially, Azure Cloud Shell runs on Azure Linux specifically within a containerized environment, not a full virtual machine (VM). This distinction is vital: a container shares the host kernel's resources, whereas a VM owns its resources, establishing a more robust isolation boundary.

Initially, Azure Cloud Shell containers did not have outbound network access, and users were explicitly not granted root access, operating in an unprivileged mode. Microsoft's security guidance, particularly after the vulnerabilities discussed in this talk were reported, emphasized that instances of the cloud shell run on isolated VMs and user data is stored outside the container. This design aims to prevent user data exposure even if a container escape occurs, as VMs are not reused. However, the speakers highlight that, despite these measures, a container cannot be considered a definitive security boundary on its own. The fundamental problem addressed by the researchers was the ability to elevate privileges from an unprivileged asuser account to root within this supposedly secure, containerized environment.

Key Findings

▶ Watch: Answering the root access question in Cloud Shell (4:25)

The researchers identified and reported two distinct vulnerabilities to Microsoft Security Response Center (MSRC), both of which enabled them to achieve root access within the Azure Cloud Shell environment:

1. Open vSwitch Integer Manipulation Vulnerability: This flaw was categorized as an escalation of privilege with important severity. It specifically involved an out-of-bounds write privilege escalation within the Open vSwitch kernel module. By manipulating integer values, the attackers could achieve unauthorized memory access, leading to arbitrary code execution with elevated privileges.
2. NFTables Use-After-Free (UAF) Vulnerability: This second vulnerability was classified as moderate severity and centered around a dangling pointer issue within the Netfilter (NFTables) framework. The UAF condition, arising from improper reference counting in the same transaction unit, granted attackers potential unauthorized access and control over the system. This specific vulnerability allowed for a more comprehensive exploit chain, including a Heap address leak and a Kernel Address Space Layout Randomization (KASLR) bypass, ultimately leading to full root access.

Both vulnerabilities successfully allowed the researchers to transition from an unprivileged asuser account to a root shell within the Azure Cloud Shell, demonstrating a complete compromise of the container's security boundary. The kernel version targeted was approximately 5.10.1.0, highlighting that even relatively recent kernel versions can harbor such critical flaws.

Technical Deep Dive

▶ Watch: Two critical vulnerabilities discovered and reported (5:00)

The core of the technical deep dive focuses on the NFTables Use-After-Free (UAF) vulnerability, which is rooted in improper reference counting within the Linux kernel's Netfilter framework. Netfilter is a crucial packet filtering framework responsible for network address translation (NAT) and firewalling functions within the kernel.

The Netfilter process involves packets traversing a series of "hooks" in the networking stack:

1. Pre-routing Hook: First point of interaction for incoming packets.
2. Routing Decision: Determines the packet's destination.
3. Kernel Netfilter Hooks: Further processing based on configured rules.
4. Post-routing Hook: Final stage before packet egress.

Within this framework, NFTable components facilitate interprocess communication between user space and kernel space. Key components include nft_start for initializing a process, new_table, new_chain, new_rule for creating network configurations, and deletion_rule for removing them.

The main flaw identified was an improper reference counting mechanism. Specifically, if a network stack element, such as a set (S) or a chain (C), expires or is skipped before its reference count is properly updated, it leads to an incorrect count. This invalid count can result in an invalid memory access and, critically, a use-after-free (UAF) condition. The researchers focused on exploiting this in the "abort" phase of a Netfilter transaction.

Netfilter transactions typically involve three phases:

1. Prepare Phase: The kernel scans incoming packets and prepares for operations, including the removal of chains from the network stack.
2. Commit Phase: The kernel traverses the prepared list, determining actions like memory allocation or deallocation. A critical issue here is that the reference count might not be validly updated, especially during concurrent operations.
3. Release Phase: This phase is responsible for cleanup, including freeing memory and resources. The vulnerability lies here, where improper error handling fails to validate negative reference counts, leading to the UAF.

The researchers performed a detailed code analysis, specifically pointing to the netfilter/api.c file within the Linux kernel. Key code segments involved:

• initialize_transaction: This function is responsible for allocating memory for a message type structure and validating input. Initial attempts to leak commit credentials failed, necessitating reverse engineering and breakpoint analysis to understand the memory layout and flow.
• new_objects_set_initial_state / activate_preparation: These functions handle the creation and activation of new tables, chains, and rules, often using a linked list structure to manage message types. The concept of RCU (Read-Copy-Update) is used for managing object states, particularly when an object might expire before its intended deletion.
• Commit Phase Analysis: The critical part in this phase is traversing the commit list and ensuring proper error handling for reference counts. The code performs operations like creating, updating, or deleting objects. However, the flaw is that if a transaction fails to correctly update the reference count during this phase, it sets up the UAF condition.
• Release Phase Analysis: In this phase, memory and resources are freed using NFTable_transaction_destroy, and the commit list is traversed again to decrease reference counts. The core vulnerability is the missing error handling for negative reference counts. The code does not validate that packet counts remain non-negative, allowing an attacker to decrement the count to zero or below prematurely. When the reference count reaches zero, the memory associated with the object is freed, even if it's still being referenced elsewhere, creating a dangling pointer and the UAF condition.

The specific vulnerability in netfilter/api.c was found in the code responsible for deactivating and unbinding nft_table_set elements. An nft_transaction_prepare_error case was observed to fail in deactivating and updating the element's reference count. If the flag_set_anonymous flag was set and an additional cleanup operation was performed, it further exacerbated the issue, leading to a dangling pointer and an invalid state. This scenario allowed an attacker to free memory that was still in use, paving the way for arbitrary code execution.

The exploit chain developed by the researchers leveraged these issues:

1. Batch Initialization: Setting up the necessary Netfilter hooks and structures.
2. Set Allocation: Allocating a memory region, typically 64 bits (though 128 bits were attempted but not supported by the kernel version).
3. Set Release: Associating the allocated set with specific tables and chains.
4. Premature Deactivation: Causing the set to be improperly deactivated, leading to its memory being freed while still referenced.
5. Syscall: Triggering a system call to exploit the freed memory, achieving root access.

This meticulous exploit chain demonstrated how a seemingly subtle flaw in reference counting could be weaponized to gain complete control over a system running a Linux kernel version 5.10.1.0.

Demo / Proof of Concept

▶ Watch: Deep dive into Netfilter and NFtables concepts (6:20)

The talk included a recorded demonstration of the exploits in action within the Azure Cloud Shell environment. Before running the exploit, the id command was executed, confirming the user was operating as an unprivileged asuser.

The demonstration showcased two distinct exploits:

1. Open vSwitch Integer Manipulation Exploit: Upon executing the custom exploit code, the shell immediately transitioned from asuser to a root shell. This visually confirmed the successful privilege escalation achieved through the integer manipulation vulnerability in the Open vSwitch kernel module.
2. NFTable Use-After-Free Exploit: The second part of the demo, focused on the NFTable UAF, was even more impactful. Running this exploit not only granted root access but also successfully demonstrated a Heap address leak and a Kernel Address Space Layout Randomization (KASLR) bypass. These additional capabilities are crucial for reliable exploitation in modern systems, as they overcome common memory protection mechanisms, further solidifying the complete compromise.

Both demonstrations clearly illustrated the effectiveness of the discovered vulnerabilities in breaking out of the intended unprivileged asuser context and gaining full administrative control within the Azure Cloud Shell.

Defensive Implications

▶ Watch: Explaining the improper reference counting and UAF flaw (8:40)

The discovery and successful exploitation of these vulnerabilities triggered a response from Microsoft Security Response Center (MSRC). As a direct fix, MSRC released an updated kernel version for Azure Cloud Shell, specifically mentioning an update around January 14th. This patch aimed to remediate the identified flaws, particularly the improper reference counting in Netfilter and the Open vSwitch vulnerability.

MSRC's existing security controls, prior to the fix, were based on the assumption that container boundaries were "inescapable." However, the researchers' work proved this assumption false. Post-fix, MSRC reiterated that Azure Cloud Shell operates as a single-user execution environment. This means that even if a user elevates to root, they should theoretically only be able to access resources within their own user session, and the design ensures that container escapes do not compromise other tenants.

However, the speakers offered several critical counter-points and ongoing research areas:

• Cross-Tenant Isolation: The claim that cross-tenant compromise is prevented is debatable. The speakers questioned whether open ports could still allow for bypassing Hyper-V isolation, which would require further research into the "blackbox nature" of the underlying virtualization.
• Hardened sudo: MSRC implemented hardening measures, such as modifying sudo -L to explicitly state "no new privileges," effectively preventing users from easily gaining root through standard sudo commands.
• Escapable Container Capabilities: Despite MSRC's efforts, the speakers noted that certain container capabilities, such as the cap_sys_admin flag, which is enabled by default in Linux and utilized by MSRC, are still escapable. This suggests that even with updated kernels and hardened configurations, pathways for privilege escalation or container escapes might persist, requiring continuous vigilance and deeper research into the interaction between kernel capabilities and container runtimes.

The research underscores that while patching specific vulnerabilities is essential, a defense-in-depth strategy must continuously re-evaluate the strength of isolation layers and assume that sophisticated attackers will always seek to challenge security boundaries.

Key Takeaways

• Container Security is Crucial and Complex: Containerized environments, even in managed cloud services like Azure Cloud Shell, require continuous scrutiny. The assumption that containers provide an inherent, strong security boundary can be dangerously misleading.
• Isolation Layers Are Not Foolproof: Technologies like NSJail and Hyper-V, designed for isolation, are not impenetrable. Sophisticated kernel vulnerabilities can bypass these layers, leading to container escapes and host compromise.
• Kernel Vulnerabilities Remain a Significant Threat: Improper reference counting, use-after-free conditions, and integer manipulation flaws in kernel modules are critical bug classes that can lead to severe privilege escalation and system control.
• Proactive Research is Essential: The motivation to gain root access to install a tool highlights the value of "breaking it" when default configurations restrict functionality. This mindset drives the discovery of vulnerabilities that enhance overall security.
• Sandboxes Can Be Compromised: The talk reinforces that sandboxes, including cloud shell environments, are not foolproof. Attackers can leverage kernel-level flaws to escape these confined environments and gain access to the underlying host.
• Security is a Team Sport: The collaborative effort between researchers and MSRC in identifying, reporting, and patching these vulnerabilities emphasizes the importance of a robust vulnerability disclosure process and the shared responsibility in securing complex systems.

About the Speaker(s)

Wami is a researcher at the Indian Institute of Science. Her primary areas of research focus on the intersection of machine learning for cybersecurity and AI-driven risk scoring, indicating a strong background in leveraging advanced analytics for security challenges.

Abhishek is a software developer at Nokia, with a significant passion and expertise in cloud security, kernel exploitations, and bug bounty programs. He has a notable track record, including the discovery of CVE-2025 related to a speculative store bypass. Abhishek is also an alumnus of Team Bios, a competitive CTF (Capture The Flag) player, and a recognized contributor on the MSRC Q3 2024 leaderboard. His motivation for this particular research stemmed from a practical need: he wanted to install a new tool in Azure Cloud Shell but required root access, leading him to investigate methods for privilege escalation. The success rate for their exploit was reported as 7 out of 10, working on specific kernel versions, and he has successfully applied similar techniques in environments like Google Kernel CTFs. Abhishek is currently engaged in ongoing research into security misconfigurations in other cloud platforms like AWS, particularly focusing on S3 bucket lists and similar SSRC (Security Sensitive Resource Control) issues.