CVE-2020-2025CWE-284

Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file

High · published May 19, 2020

CVSS v3.1
8.8
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2020-05-19T21:05Z
EPSS history
Timeline
  • 19 MAY 21:05Z
    Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file
    cvelistv5