CVE-2020-2026CWE-59

Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path

High · published June 10, 2020

CVSS v3.1
7.8
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2020-06-10T17:27Z
EPSS history
Timeline
  • 10 JUN 17:27Z
    Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path
    cvelistv5