Vulnerability · Published May 19, 2020 · Assigned by palo_alto
CVE-2020-2025Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file
High 8.8
In plain English
A high-severity improper access control in Kata Containers from Kata Containers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 75.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kata Containers | Kata Containers | unspecified – before 1.11.0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/kata-containers/runtime/pull/2487 x_refsource_MISC