CVE-2020-2023 Kata Containers - Containers have access to the guest root filesystem device

2020-06-1000:00:00

CWE-250

palo_alto

www.cve.org

3.8 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.3%

JSON

Kata Containers doesn’t restrict containers from accessing the guest’s root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

CNA Affected

[
  {
    "product": "Kata Containers",
    "vendor": "Kata Containers",
    "versions": [
      {
        "lessThan": "1.11.1",
        "status": "affected",
        "version": "1.11",
        "versionType": "custom"
      },
      {
        "lessThan": "1.10.5",
        "status": "affected",
        "version": "1.10",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "1.9",
        "status": "affected",
        "version": "1",
        "versionType": "custom"
      }
    ]
  }
]