Vulnerability · Published May 19, 2020 · Assigned by palo_alto
CVE-2020-2024Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host
Medium 6.5
In plain English
A medium-severity security flaw in Kata Containers from Kata Containers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kata Containers | Kata Containers | unspecified – before 1.11.0 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
References
- https://github.com/kata-containers/runtime/issues/2474 x_refsource_MISC
- https://github.com/kata-containers/runtime/pull/2475 x_refsource_MISC