Bulkhead: Automated Semantic Detection and Remediation of Container Escape Vulnerabilities

2026-07-14

AI Summary

This work addresses the challenge of path traversal (PaTra) vulnerabilities in containerized environments, which often arise from erroneous cross-boundary path resolution and are inadequately handled by existing detection and mitigation approaches due to high false-positive rates, poor scalability, or excessive intrusiveness. To overcome these limitations, the authors propose Bulkhead, a novel framework that uniquely integrates large language models with formal verification within a multi-agent system to automatically discover and repair container escape vulnerabilities. Bulkhead identifies high-risk functions and call-chain patterns to pinpoint cross-boundary interaction points, generates proof-of-concept exploits for validation, and drives the synthesis of formally verified patches. Experimental results demonstrate that Bulkhead effectively detects missing security checks and time-of-check-to-time-of-use (TOCTOU) vulnerabilities, substantially reducing false positives while achieving semantic-level precision in both detection and automated remediation.

Abstract

Filesystem isolation in container ecosystems is often weakened by cross-boundary path misresolution, causing path traversal (PaTra) vulnerabilities. These vulnerabilities stem from insecure host-container interactions and have become increasingly pervasive as cloud systems mount shared resources, such as GPUs and agent workspaces, into containers to support AI workloads. Existing defenses remain inadequate. Kernel-level protections are intrusive, can destabilize system calls, and have therefore not been accepted into the Linux mainline. Detection methods rely on static rule matching or manual code auditing. Static rules can flag path-related functions but fail to capture the semantics needed to determine whether a host-container interaction exists, causing many false positives. Manual review requires domain expertise, making it costly, inefficient, and difficult to scale. To address this threat, we present Bulkhead, an automated framework that integrates large language models (LLMs) with formal methods for semantic vulnerability discovery and remediation. Bulkhead uses a multi-agent system to identify and repair PaTra vulnerabilities through multi-dimensional knowledge patterns generalized from known cases. It first applies high-risk functional patterns to locate entry points for cross-boundary interactions in containerized code, then uses call-chain patterns to recover the corresponding execution paths at suitable depth. The Detection pipeline analyzes these call chains against the application scenarios and threat model, identifying vulnerabilities such as missing security checks and TOCTOU flaws in cross-boundary interactions, and generating proof-of-concept (PoC) exploits for validation. These PoCs then guide patch generation. To ensure remediation correctness, the Patch pipeline performs assertion-driven verification using predefined model-checking templates.

Problem

• container escape
• path traversal
• filesystem isolation
• vulnerability detection
• host-container interaction

Innovation

• container escape
• path traversal
• large language models
• formal verification
• automated remediation