Vulnerability · Published Jun 10, 2020 · Assigned by palo_alto
CVE-2020-2023Kata Containers - Containers have access to the guest root filesystem device
Low 3.8
In plain English
A low-severity security flaw in Kata Containers from Kata Containers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kata-containers/agent | 1.9.1 | GHSA-6978-vg2j-cc9q |
| Go | github.com/kata-containers/agent | 1.10.5 | GHSA-6978-vg2j-cc9q |
| Go | github.com/kata-containers/agent | 1.11.1 | GHSA-6978-vg2j-cc9q |
| Go | github.com/kata-containers/runtime | 1.9.1 | GHSA-6978-vg2j-cc9q |
| Go | github.com/kata-containers/runtime | 1.10.5 | GHSA-6978-vg2j-cc9q |
| Go | github.com/kata-containers/runtime | 1.11.1 | GHSA-6978-vg2j-cc9q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kata Containers | Kata Containers | 1.11 – before 1.11.11.10 – before 1.10.51 – through 1.9 |
Weakness: CWE-250 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
References
- https://github.com/kata-containers/runtime/pull/2487 x_refsource_MISC
- https://github.com/kata-containers/runtime/pull/2477 x_refsource_MISC
- https://github.com/kata-containers/runtime/issues/2488 x_refsource_MISC
- https://github.com/kata-containers/agent/issues/791 x_refsource_MISC
- https://github.com/kata-containers/agent/pull/792 x_refsource_MISC
- https://github.com/kata-containers/runtime/releases/tag/1.11.1 x_refsource_MISC
- https://github.com/kata-containers/runtime/releases/tag/1.10.5 x_refsource_MISC