About the Speaker

The Presentation talk will explore a critical Use-after-free vulnerability and novel RCU techniques found in the netfilter kernel module of Azure Cloud Shell, impacting kernel version 5.10.102.2-microsoft-standard and prior version of 6.9 , a custom kernel version used by azure cloudshell. Upon successful exploitation of this vulnerability, an attacker can achieve elevated privileges within the Azure Cloud Shell environment, potentially leading to a full container escape, allowing unauthorized access to underlying host systems and senstive  cloud resources like passwords ,  .pem files.

I will also be covering the technical aspects and the root cause of the vulnerability , including exploitation techniques used and the steps taken to achieve privilege escalation in azure cloud shell. The session will also examine the broader implications of such vulnerabilities and its mitigations enabled in multi-tenant cloud infrastructures, where a single exploit can compromise numerous tenants and finally a demo willbe showcased as a proof of concept.I had already made a responsible disclosure only with Microsoft Security Response Center(MSRC) and not yet to public, the vulnerability was acknowledged and just mitigated but there is no official patch fix yet done by Microsoft. This talk emphasizes the importance of securing kernel modules and also demonstrates how proactive research can help uncover and address critical risks in widely-used cloudplatforms like Azure. Attendees will leave with valuable insights into cloud security, kernel exploitation, and the importance of vulnerability research.

I am Kandi Abhishek Reddy, a graduate of Amrita Vishwa Vidyapeetham, Bangalore, specialization in Computer Science and Electronics Engineering. Currently, I work as a security researcher with Team bi0s, India's top-ranked Capture the Flag (CTF) team and cybersecurity research community, as well as a full-time software engineer at NOKIA as a subcontractor.

I have a strong focus and interests on binary exploitation and digital forensics, I have many accomplishments through hands-on experience in CTF competitions, where I have achieved significant milestones. Additionally, I have successfully identified and reported vulnerabilities to Microsoft, contributing to real-world security improvements.

Passionate about continuous learning, I am always seeking new challenges and opportunities to grow in the rapidly evolving fields of cybersecurity and technology.