{
  "guid": "1632d233-fb88-5f58-aaec-823ea32f8b56",
  "code": "ARLX3M",
  "id": 1975,
  "date": "2025-12-27T17:15:00+01:00",
  "start": "17:15",
  "duration": "01:00",
  "room": "Fuse",
  "slug": "39c3-escaping-containment-a-security-analysis-of-freebsd-jails",
  "title": "Escaping Containment: A Security Analysis of FreeBSD Jails",
  "subtitle": null,
  "language": "en",
  "track": "Security",
  "type": "Talk",
  "abstract": "FreeBSD\u2019s jail mechanism promises strong isolation\u2014but how strong is it really?\r\nIn this talk, we explore what it takes to escape a compromised FreeBSD jail by auditing the kernel\u2019s attack surface, identifying dozens of vulnerabilities across exposed subsystems, and developing practical proof-of-concept exploits. We\u2019ll share our findings, demo some real escapes, and discuss what they reveal about the challenges of maintaining robust OS isolation.",
  "description": "FreeBSD\u2019s jail feature is one of the oldest and most mature OS-level isolation mechanisms in use today, powering hosting environments, container frameworks, and security sandboxes. But as with any large and evolving kernel feature, complexity breeds opportunity. This research asks a simple but critical question: If an attacker compromises root inside a FreeBSD jail, what does it take to break out?\n\nTo answer that, we conducted a large-scale audit of FreeBSD kernel code paths accessible from within a jail. We systematically examined privileged operations, capabilities, and interfaces that a jailed process can still reach, hunting for memory safety issues, race conditions, and logic flaws. The result: roughly 50 distinct issues uncovered across multiple kernel subsystems, ranging from buffer overflows and information leaks to unbounded allocations and reference counting errors\u2014many of which could crash the system or provide vectors for privilege escalation beyond the jail.\n\nWe\u2019ve developed proof-of-concept exploits and tools to demonstrate some of these vulnerabilities in action. We\u2019ve responsibly disclosed our findings to the FreeBSD security team and are collaborating with them on fixes. Our goal isn\u2019t to break FreeBSD, but to highlight the systemic difficulty of maintaining strict isolation in a large, mature codebase.\n\nThis talk will present our methodology, tooling, and selected demos of real jail escapes. We\u2019ll close with observations about kernel isolation boundaries, lessons learned for other OS container systems, and a call to action for hardening FreeBSD\u2019s jail subsystem against the next generation of threats.\n",
  "logo": null,
  "persons": [
    {
      "guid": "4f9a4e67-cc78-56cd-bf04-859f68e57867",
      "name": "ilja",
      "public_name": "ilja",
      "avatar": "https://cfp.cccv.de/media/avatars/BZMUY7_mpiH3jc.jpeg",
      "biography": "Ilja van Sprundel is a security researcher that loves to find out new things.\n\nHe\u2019s currently employed by a company called IOActive where he gets to play with all sorts of weird and exciting security technologies.\n",
      "url": "https://events.ccc.de/congress/2025/hub/en/user/speaker_4f9a4e67-cc78-56cd-bf04-859f68e57867"
    },
    {
      "guid": "c9aecf86-a3ed-55ff-91a5-472c19e1aca9",
      "name": "Michael Smith",
      "public_name": "Michael Smith",
      "avatar": "https://cfp.cccv.de/media/avatars/SH97EW_MguRRVV.jpg",
      "biography": "Michael Smith is an independent Programmer, System Administrator and IT Consultant with over 20 years of professional and international experience. His hobbies and interests include IT security research, email systems, retro gaming, radio and music. He has lived and worked in Dubai, Indonesia and the United States. He currently lives in Antwerp, Belgium with his partner and two kids.\n",
      "url": "https://events.ccc.de/congress/2025/hub/en/user/speaker_c9aecf86-a3ed-55ff-91a5-472c19e1aca9"
    }
  ],
  "url": "https://events.ccc.de/congress/2025/hub/en/event/detail/escaping-containment-a-security-analysis-of-freebsd-jails",
  "links": [],
  "origin_url": "https://cfp.cccv.de/39c3/talk/ARLX3M/",
  "feedback_url": "https://cfp.cccv.de/39c3/talk/ARLX3M/feedback/",
  "do_not_record": false,
  "do_not_stream": null
}