This vulnerability in unionfs.sys is being undersold by its CVSS 5.5 rating. The score reflects a generic 'tampering' vector, but in a containerized environment, 'tampering' via link following in a kernel-mode filter driver means something far more serious: a process inside a container can modify files outside its allocated filesystem namespace. This is not a privilege escalation in the traditional sense—it is a container escape that could allow a compromised workload to write to host binaries, configuration files, or other containers' filesystem layers.
The 'authorized attacker' framing is narrower than it appears. In container deployments, authorization often means simply being a workload running inside the container—a far lower bar than local access to a host. The EPSS of 0.00365 indicates limited current exploitation, but this could shift rapidly if proof-of-concept code surfaces, particularly given how Windows containers are deployed in production environments where this driver enforces isolation boundaries.
The core issue: unionfs.sys is a kernel-mode filter driver responsible for container filesystem layering and namespace enforcement. When resolving paths containing symbolic links, the driver was not validating that the link target remained within the container's namespace before performing the write operation. This allowed path traversal through symlinks to bypass the isolation boundary the driver is supposed to enforce.
Forensic steps you should take now: First, determine whether your Windows container deployment uses process isolation or Hyper-V isolation, as the attack surface differs. Second, audit any custom filter drivers in your container stack for similar link resolution patterns—the same cognitive fragmentation that caused this flaw (path resolution code separate from access validation code) likely exists elsewhere. Third, verify the patch adds canonicalization checks at the right abstraction layer in the filter manager callbacks, not just at one call site.
The deeper concern: this flaw likely represents a known mutation family in Windows filter drivers—legacy path resolution code written for single-namespace filesystem layering, later repurposed as multi-tenant isolation infrastructure without re-auditing the link resolution paths. Ask whether your driver is instantiated per-container or shared across the runtime; if shared, one compromised container could corrupt isolation state protecting all co-located workloads. That changes the threat model from 'malicious workload modifies host' to 'malicious workload poisons isolation for everyone on the host.'