CVE-2020-2023lowCWE-250

CVE-2020-2023: low-severity vulnerability in Kata Containers

Kata Containers - Containers have access to the guest root filesystem device

Published · Updated

Follow this CVE+ Monitor kata-containers+ Monitor github.com/kata-containers/runtime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.8epss 1.1%
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Affected products
Kata Containers · Kata Containers
Related CVEs — Kata Containers

In the same product, most dangerous first.

CVE-2020-2026HIGHKata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathEPSS 0.5%CVE-2020-2024MEDIUMKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostEPSS 0.4%CVE-2020-2025HIGHKata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image fileEPSS 0.3%