T1611Privilege Escalation
Escape to Host
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment. There…
CVEs6
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.5
Reports1
Detections
2 Sigma rules tagged T1611Escape to HostT16112 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Escape to Host
6 CVEs, by priority. Each link shows its badge.- CVE-2022-0492Linux Kernel Improper Authentication VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1611Escape to HostAI mapping from the description · primary impact5.5%Top 7.2%72.0priority
- CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityMITRE CTID mapping of the KEV entry · primary impact1.6%Top 25%68.8priority
- CVE-2025-22226VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity1.6%Top 24%67.4priority
- CVE-2025-22225VMware ESXi Arbitrary Write VulnerabilityMITRE CTID mapping of the KEV entry · primary impact1.0%Top 37%66.4priority
- CVE-2019-5736runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc…AI mapping from the description · primary impact98.5%Top 0.08%66.2priority
- CVE-2020-16017Google Chrome Use-After-Free VulnerabilityAI mapping from the description · primary impact2.7%Top 14%61.9priority