Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
google/cadvisor
master @ 6a0c4f2
11
Fixes
0
CVEs
CRITICAL
Peak severity
100.0%
Coverage
Highlights
Denial of Service: 6 prior fixes. Scrutinize any change in this area.
manager/container.go: most-fixed (3 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Container Escape: Two separate dependency bumps to runc were required to fix critical container escape vulnerabilities in namespace setup (nsexec, setns_init_linux). This is the highest-impact risk class.
Container Escape: Containerd v1.0.2 bump fixed container escape and privilege escalation via symlink/grpc paths. This is a separate critical dependency from runc.
Auth Bypass: HTTP handlers lacked authentication, exposing monitoring endpoints. The fix added Basic and Digest auth wrappers, but sibling endpoints may still be unguarded.