Torpedo: A Fuzzing Framework for Discovering Adversarial Container Workloads

Containers enable a computing system to host multiple isolated applications, making more cost-efficient use of the available computing resources. However, exploiting shared computing resources, adversaries can launch various real-world attacks (e.g., denial-of-service attacks) inside containers. In this paper, we present TORPEDO, a fuzzing-based approach to detecting out-of-band workloads: such workloads could largely interfere the performance of colocated container instances on the same host, gaining extra unfair advantages on the system resources without being charged appropriately. TORPEDO mutates inputs of OS syscalls and simultaneously monitors the resource consumption of multiple container instances. It uses resource-guided heuristics to find inputs that maximize the difference in resource consumption between container instances and resource limits. We evaluate TORPEDO on widely-used containerization platforms and demonstrate that it can verify adversarial workloads that are manually discovered by existing research. More importantly, TORPEDO identifies several zero-day vulnerabilities that are not known to the public.

I. Introduction

Containerization platforms provide environments to isolate and provision processes running on the same host. Unlike conventional virtualization techniques maintaining an individual copy of the operating system (OS) and libraries for each instance, containers enable much more lightweight and standalone isolation toward user applications. Container instances on the same host share the same OS kernel, thus reducing computing costs by stacking kernels and driving much higher server efficiencies. To date, container techniques have been widely adopted in many scenarios including cloud computing, serverless computing, and edge computing. The value of the container market is expected to reach $8.2 billion in 2025 [3] as compared to $762 million in 2016 [64].