Vulnerability · Published Sep 23, 2025 · Assigned by GitHub_M
CVE-2025-58354Kata Containers coco-tdx malicious host can circumvent initdata verification
Medium 6.9
In plain English
A medium-severity security flaw in kata-containers from kata-containers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kata-containers | kata-containers | < 3.21.0 |
Weakness: CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N