Katacontainers Runtime vulnerabilities
4 vulnerabilities
Known vulnerabilities in Katacontainers Runtime, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2020-2023kata containers +3 moreKata Containers - Containers have access to the guest root filesystem deviceKata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.CVSS6.3MediumEPSS1.15%RoutineCVE-2020-2026kata containers +3 moreKata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathA malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.CVSS8.8HighEPSS0.47%RoutineCVE-2020-2025kata containers +1 moreKata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image fileKata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.CVSS8.8HighEPSS0.31%RoutineCVE-2020-2024kata containers +1 moreKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostAn improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS.CVSS6.5MediumEPSS0.37%