CVE-2020-2024 Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host

2020-05-1900:00:00

CWE-59

palo_alto

www.cve.org

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS.

CNA Affected

[
  {
    "product": "Kata Containers",
    "vendor": "Kata Containers",
    "versions": [
      {
        "lessThan": "1.11.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]