A critical vulnerability in Google gVisor allows an authenticated local attacker to escalate privileges to root on the host system.

This flaw involves an improper exposure of resources within the gVisor gofer helper, specifically when CUSE is enabled. An authenticated attacker with container image deployment privileges can leverage CUSE ioctl handling to overwrite root udev helper memory, resulting in unauthorized root code execution on the host.

Successful exploitation of this vulnerability results in full host system compromise, as the attacker achieves root-level code execution. This bypasses the security isolation provided by the container sandbox, potentially leading to total data loss, unauthorized access to sensitive host information, and complete system downtime. Given the high CVSS score of 8.8, this represents a severe threat to infrastructure integrity.

Immediate Action: Update gVisor to the latest version or apply the fix provided in commit 573a9e73cf844f.

Proactive Monitoring: Monitor host system logs for unauthorized access to /dev/cuse or unexpected udev helper process activity.

Compensating Controls: Disable CUSE functionality within the gVisor configuration if it is not strictly required for container operations to reduce the attack surface.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the potential for full host takeover from within a containerized environment. Security teams should prioritize patching the gVisor runtime immediately. If patching is not immediately feasible, administrators must evaluate the necessity of CUSE within their environment and disable it as a temporary measure to eliminate the primary attack vector.