CVE-2020-2023CWE-250

Kata Containers - Containers have access to the guest root filesystem device

Low · published June 10, 2020

CVSS v3.1
3.8
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01139 · 66.4th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2020-06-10T17:30Z
EPSS history
Timeline
  • 10 JUN 17:30Z
    Kata Containers - Containers have access to the guest root filesystem device
    cvelistv5