What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant
This Securelist article discusses the security risks associated with containerization using Docker, particularly the prevalence of outdated and vulnerable software within pre-built images. The article highlights how attackers can exploit these vulnerabilities for various malicious activities, including DDoS attacks and data theft. Kaspersky’s Container Security solution, featuring the KIRA AI assistant, is presented as a tool to identify and mitigate these risks by analyzing images for vulnerabilities and misconfigurations.
Containerization, driven by technologies like Docker, has become a standard in modern software development, increasing deployment speed and convenience. However, this widespread adoption has created a significant attack surface. Compromised containers can be leveraged for a range of malicious activities, including DDoS attacks, cryptocurrency mining, and acting as traffic proxies. The core issue lies in the frequent use of pre-built images, often containing outdated software and vulnerable versions, due to a lack of automated updates. Developers frequently rely on these images, making it easy to introduce misconfigurations that attackers can exploit. The architectural nature of containers further complicates security efforts, often forcing developers to seek insecure solutions online.
One critical vulnerability stems from the infrequent updates applied to container images. Unlike traditional Linux servers that receive automatic security patches, Docker images typically remain static after their initial build. This means vulnerabilities discovered in the underlying packages accumulate over time, significantly increasing the risk of exploitation. Recent examples include the exploitation of CVE-2025-55182 in React Server Components, which was adopted by various threat actors, including those utilizing Mirai and Gafgyt malware. Attackers are constantly adapting their tactics, utilizing new distribution methods and exploiting configuration errors in popular services.
Furthermore, attackers are increasingly targeting local vulnerabilities within containers to gain root privileges and escape the container environment. Campaigns like Kinsing and perfctl have leveraged vulnerabilities such as CVE-2023-4911 and CVE-2021-4034, respectively, to achieve this. These techniques are used to install rootkits, further obscuring the presence of malicious activity. The article emphasizes the need for heightened attention to container security and the use of tools like Kaspersky Container Security to proactively identify and address these vulnerabilities.