PT-2019-11596 · Coreos · Rkt

Publicado 2019-06-03 · Atualizado 2020-09-30 · CVE-2019-10144

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: rkt versions prior to 1.30.0

Description: The issue allows compromised containers to potentially access host resources due to a lack of isolation for processes run with rkt enter. This occurs because processes run with rkt enter are given all capabilities during stage 2, which is the actual environment where applications run.

Recommendations: For versions prior to 1.30.0, update to version 1.30.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of rkt enter to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

CWE-250

Identificadores relacionados

CVE-2019-10144

Produtos afetados

Rkt

Referências · 8

• 🔥 https://twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves · Exploit
• https://github.com/rkt/rkt/issues/3998 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10144 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10144 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-10144 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10144 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-10144 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-10144 · Nota de Segurança