CVE-2020-2023lowCWE-250

CVE-2020-2023: falha de baixa gravidade em Kata Containers

Kata Containers - Containers have access to the guest root filesystem device

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar kata-containers+ Monitorar github.com/kata-containers/runtime

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.8epss 1.1%
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
Kata Containers · Kata Containers
CVEs relacionadas — Kata Containers

No mesmo produto, das mais perigosas para as menos.

CVE-2020-2026HIGHKata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathEPSS 0.5%CVE-2020-2024MEDIUMKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostEPSS 0.4%CVE-2020-2025HIGHKata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image fileEPSS 0.3%