Processes spawned by the ‘rkt enter’ command run with are not limited by cgroups during stage 2 ((the actual environment in which the applications run). Such processes could consume host resources to cause a denial of service. Reference: https://coreos.com/rkt/docs/latest/devel/architecture.html#stage-2
Acknowledgments: Name: Yuval Avrahami (Twistlock)
Created rkt tracking bugs for this issue: Affects: fedora-all [bug 1715685]
External Reference: https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.