PT-2020-15248 · Kata Containers · Kata Containers

Bergwolf · Published 2020-05-19 · Updated 2020-05-21 · CVE-2020-2024

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 1.11.0

Description The issue is related to an improper link resolution, which can be exploited by a malicious guest upon container teardown. This can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentially resulting in a host Denial of Service (DoS).

Recommendations For versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue.

Fix

DoS

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2020-2024

Affected Products

Kata Containers

References · 6

• https://github.com/kata-containers/runtime/pull/2475 · Patch
• https://osv.dev/vulnerability/CVE-2020-2024 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5766.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2024 · Security Note
• https://linux.oracle.com/errata/ELSA-2020-5765.html · Vendor Advisory
• https://github.com/kata-containers/runtime/issues/2474 · Note