CVE-2020-2026

 

Published at: - 10-06-2020 08:15

Last modified: - 16-11-2022 04:40

Total changes: - 2

Description

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/kata-containers/runtime/issues/2712
• https://github.com/kata-containers/runtime/releases/tag/1.10.5
• https://github.com/kata-containers/runtime/pull/2713
• https://github.com/kata-containers/runtime/releases/tag/1.11.1
• FEDORA-2020-2f5879aeb6-Mailing List, Third Party Advisory
• FEDORA-2020-7a0b6071a4-Mailing List, Third Party Advisory
• FEDORA-2020-c33083813d-Mailing List, Third Party Advisory
• FEDORA-2020-15a1bde727-Mailing List, Third Party Advisory
• FEDORA-2020-61fcf3ffc7-Mailing List, Third Party Advisory
• FEDORA-2020-1af9cd8c87-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2020-2026

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures