← Back

CVE-2020-2023

nvd nist
Published: Jun 10, 2020Modified: Nov 21, 2024

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Exploitability: 2.0 / Impact: 3.7
Source: NVD

Description

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

Affected (3)

Katacontainers
1 product
Runtime
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Katacontainers
Runtime
Up to 1.9
Runtime
From 1.10 to 1.10.5
Runtime
From 1.11 to 1.11.1

Related CWEs

CWE-250
Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (14)

Source: psirt@paloaltonetworks.com
Third Party Advisory
Source: psirt@paloaltonetworks.com
Patch
Source: psirt@paloaltonetworks.com
PatchThird Party Advisory
Source: psirt@paloaltonetworks.com
PatchThird Party Advisory
Source: psirt@paloaltonetworks.com
PatchThird Party Advisory
Source: psirt@paloaltonetworks.com
Release NotesThird Party Advisory
Source: psirt@paloaltonetworks.com
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory

Timeline

No history available yet.