GitHub Advisory DatabaseGHSA-6978-VG2J-CC9QImproper Privilege Management and Execution with Unnecessary Privileges in Kata Containers
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
6.3 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
0.001 Low
EPSS
Percentile
23.3%
Kata Containers doesn’t restrict containers from accessing the guest’s root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
Affected configurations
References
github.com/advisories/GHSA-6978-vg2j-cc9q
github.com/kata-containers/agent/issues/791
github.com/kata-containers/agent/pull/792
github.com/kata-containers/runtime/issues/2488
github.com/kata-containers/runtime/pull/2477
github.com/kata-containers/runtime/pull/2487
github.com/kata-containers/runtime/releases/tag/1.10.5
github.com/kata-containers/runtime/releases/tag/1.11.1
nvd.nist.gov/vuln/detail/CVE-2020-2023
Related
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
6.3 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
0.001 Low
EPSS
Percentile
23.3%