PT-2019-11598 · Coreos · Rkt

Published 2019-06-03 · Updated 2020-09-30 · CVE-2019-10147

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: rkt versions prior to 1.30.0

Description: The issue allows compromised containers to access host resources due to a lack of isolation for processes run with rkt enter. This occurs because processes run in this manner are not limited by cgroups during stage 2, which is the environment where applications actually run.

Recommendations: For versions prior to 1.30.0, update to version 1.30.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of rkt enter to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-250

Related Identifiers

CVE-2019-10147

Affected Products

Rkt

References · 8

• 🔥 https://twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10147 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10147 · Security Note
• https://ubuntu.com/security/CVE-2019-10147 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10147 · Security Note
• https://github.com/rkt/rkt/issues/3998 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10147 · Note