CVE-2020-2024

Опубликовано: 19 мая 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 2.1

EPSS Низкий

Описание

An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS.

Ссылки

https://github.com/kata-containers/runtime/issues/2474
Third Party Advisory
https://github.com/kata-containers/runtime/pull/2475
Patch
Third Party Advisory
https://github.com/kata-containers/runtime/issues/2474
Third Party Advisory
https://github.com/kata-containers/runtime/pull/2475
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:*

Версия до 1.11.0 (исключая)

EPSS

Процентиль: 33%

0.00123

Низкий

6.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-59

Связанные уязвимости

ELSA-2020-5766

oracle-oval

почти 5 лет назад

ELSA-2020-5766: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne security update (IMPORTANT)

ELSA-2020-5765