PT-2019-11597 · Coreos · Rkt

Publicado 2019-06-03 · Atualizado 2020-10-02 · CVE-2019-10145

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: rkt versions prior to 1.30.0

Description: The issue concerns a lack of isolation for processes in containers run with rkt enter, specifically due to the absence of seccomp filtering during stage 2. This could allow compromised containers to access host resources.

Recommendations: For versions prior to 1.30.0, update to version 1.30.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of rkt enter to minimize the risk of exploitation.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-250

Identificadores relacionados

CVE-2019-10145

Produtos afetados

Rkt

Referências · 8

• 🔥 https://twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves · Exploit
• https://github.com/rkt/rkt/issues/3998 · Nota
• https://cve.org/CVERecord?id=CVE-2019-10145 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10145 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10145 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10145 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10145 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-10145 · Aviso do Fabricante