☸️CIS Kubernetes 5.2.3Rule: K8S-PS-003high

Minimize hostIPC

Description

Pods should not use hostIPC (shares Inter-Process Communication with host).

⚠️ Risk Impact

hostIPC allows pod processes to communicate with host processes via shared memory + semaphores — bypasses container isolation.

🔍 How EchelonGraph Detects This

K8S-PS-003Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🔧 Remediation

Remove hostIPC: true from PodSpecs. Enforce via Pod Security admission.

💀 Real-World Attack Scenario

A debugging container ran with hostIPC for shared memory access. Compromise enabled the container to read shared-memory regions of host processes — including credential material in host process memory.

💰 Cost of Non-Compliance

Container-escape via hostIPC: rare but high-impact.

📋 Audit Questions

  • 1.Any pods with hostIPC?
  • 2.Justified?
  • 3.PSS enforcement?

🎯 MITRE ATT&CK Mapping

T1611 — Escape to Host

⚡ Common Pitfalls

  • ⛔Performance optimization via hostIPC
  • ⛔Debug tools with hostIPC

📈 Business Value

hostIPC restriction maintains container isolation.

⏱️ Effort Estimate

Manual

Audit

With EchelonGraph

EchelonGraph enforces via PSS

Automate CIS Kubernetes 5.2.3 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →