PT-2020-17052 · Kata · Kata Containers

Published 2020-11-17 · Updated 2021-03-05 · CVE-2020-28914

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 1.11.5

Description An improper file permissions issue affects Kata Containers when using a Kubernetes hostPath volume. When a file or directory is mounted as readonly into a container, it remains writable inside the guest. This could allow a malicious guest to modify or delete files/directories expected to be read-only in a container breakout situation.

Recommendations For versions prior to 1.11.5, update to version 1.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of hostPath volumes or ensuring that all mounted files and directories are properly secured to prevent unauthorized access.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-28914

OESA-2021-1084

Affected Products

Kata Containers

References · 14

• https://linux.oracle.com/errata/ELSA-2021-9028.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28914 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9029.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28914 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1084 · Vendor Advisory
• https://github.com/kata-containers/kata-containers/pull/1062 · Note
• https://github.com/kata-containers/runtime/pull/3042 · Note
• https://github.com/kata-containers/runtime/releases/tag/1.11.5 · Note
• https://github.com/kata-containers/runtime/pull/3051 · Note
• https://github.com/kata-containers/runtime/releases/tag/1.12.0 · Note
• https://t.me/cvenotify/6590 · Telegram Post
• https://t.me/cibsecurity/16488 · Telegram Post
• https://t.me/freedomf0x/10635 · Telegram Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1084 · Note