Minimize Admission of Containers with NET_RAW Capability (CIS 5.2.8)

Impact & Risk Analysis

Severity: Medium
CIS Benchmark: CIS 5.2.8
Impact: Network Spoofing & Traffic Interception. The NET_RAW capability allows a process to craft raw network packets. If a malicious container has this capability (which is enabled by default in Docker), an attacker can perform ARP spoofing, DNS spoofing, or create custom packets to bypass network firewalls within the cluster.

Common Misconfiguration

Running containers with default capabilities. Most container runtimes (like Docker) grant NET_RAW by default to allow tools like ping to work, but standard web applications and microservices rarely need it.

Vulnerable Example

# Vulnerable Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: default-caps-pod
spec:
  containers:
  - name: app
    image: nginx
    # VULNERABLE: Implicitly includes NET_RAW
    # No securityContext defined to drop it

Secure Example

# Secure Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      capabilities:
        # SECURE: Drop ALL capabilities first
        drop:
          - ALL
        # OPTIONAL: Only add back what is strictly needed (e.g., binding ports)
        add:
          - NET_BIND_SERVICE

Audit Procedure

List the policies in use for each namespace or check running pods to ensure NET_RAW is dropped. Check Running Pods:

# Check if pods are dropping capabilities
kubectl get pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.spec.containers[*].securityContext.capabilities.drop}\n{end}'

Analyze: Look for ALL or NET_RAW in the drop list.
Fail: If the output is empty (meaning default capabilities are used).

Check Policies: Verify if the namespace enforces the restricted Pod Security Standard (which mandates dropping NET_RAW).

kubectl get ns --show-labels

Remediation

Update Application Manifests: Modify your Deployment YAMLs to explicitly drop NET_RAW or ALL.
Enforce Policy: Apply the restricted Pod Security Standard to your namespaces, as the baseline policy typically permits NET_RAW.

# Enforce the restricted policy (drops NET_RAW)
kubectl label --overwrite ns default pod-security.kubernetes.io/enforce=restricted

Getting Started

Product Guides

Integrations

Supported Languages

Vulnerability Reference

Security & Trust

User Management

Minimize Admission of Containers with NET_RAW Capability (CIS 5.2.8)

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation

​Impact & Risk Analysis

​Common Misconfiguration

​Vulnerable Example

​Secure Example

​Audit Procedure

​Remediation

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation