CVE-2020-2023lowCWE-250

CVE-2020-2023: fallo de gravedad baja en Kata Containers

Kata Containers - Containers have access to the guest root filesystem device

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear kata-containers+ Monitorear github.com/kata-containers/runtime

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.8epss 1.1%
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Productos afectados
Kata Containers · Kata Containers
CVEs relacionadas — Kata Containers

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-2026HIGHKata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathEPSS 0.5%CVE-2020-2024MEDIUMKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostEPSS 0.4%CVE-2020-2025HIGHKata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image fileEPSS 0.3%