GHSA-6978-vg2j-cc9qMediumCVSS 9.8

Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers

Published
February 15, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-2023 →

📋 Description

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

🎯 Affected products6

  • go/github.com/kata-containers/agent:<= 1.9
  • go/github.com/kata-containers/agent:>= 1.10.0, < 1.10.5
  • go/github.com/kata-containers/agent:>= 1.11.0, < 1.11.1
  • go/github.com/kata-containers/runtime:<= 1.9
  • go/github.com/kata-containers/runtime:>= 1.10.0, < 1.10.5
  • go/github.com/kata-containers/runtime:>= 1.11.0, < 1.11.1

🔗 References (9)