CVE-2020-2026highCWE-59

CVE-2020-2026: falha de alta gravidade em Kata Containers

Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar kata-containers+ Monitorar github.com/kata-containers/runtime

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.5%
A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Kata Containers · Kata Containers
CVEs relacionadas — Kata Containers

No mesmo produto, das mais perigosas para as menos.

CVE-2020-2023LOWKata Containers - Containers have access to the guest root filesystem deviceEPSS 1.1%CVE-2020-2024MEDIUMKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostEPSS 0.4%CVE-2020-2025HIGHKata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image fileEPSS 0.3%