PT-2020-15247 · Kata Containers · Kata Containers

Published 2020-06-10 · Updated 2022-02-15 · CVE-2020-2023

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kata Containers versions 1.11 earlier than 1.11.1 Kata Containers versions 1.10 earlier than 1.10.5 Kata Containers versions 1.9 and earlier

Description The issue allows malicious containers to access the guest's root filesystem device, potentially leading to code execution on the guest and masquerading as the kata-agent.

Recommendations For Kata Containers version 1.11, update to version 1.11.1 or later. For Kata Containers version 1.10, update to version 1.10.5 or later. For Kata Containers version 1.9 and earlier, update to a newer version that contains a fix for this issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-250

CWE-269

Related Identifiers

CVE-2020-2023

GHSA-6978-VG2J-CC9Q

Affected Products

Kata Containers

References · 12

• https://github.com/kata-containers/runtime/pull/2477 · Patch
• https://github.com/kata-containers/runtime/issues/2488 · Patch
• https://github.com/kata-containers/runtime/pull/2487 · Patch
• https://github.com/kata-containers/agent/pull/792 · Patch
• https://osv.dev/vulnerability/GHSA-6978-vg2j-cc9q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2023 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2023 · Vendor Advisory
• https://github.com/kata-containers/runtime/releases/tag/1.11.1 · Note
• https://github.com/kata-containers/runtime/releases/tag/1.10.5 · Note
• https://github.com/kata-containers/agent/issues/791 · Note
• https://github.com/kata-containers · Note
• https://t.me/k8security/374 · Telegram Post