CVE-2020-2025

Опубликовано: 19 мая 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 4.6

EPSS Низкий

Описание

Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.

Ссылки

https://github.com/kata-containers/runtime/pull/2487
Patch
Third Party Advisory
https://github.com/kata-containers/runtime/pull/2487
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:*

Версия до 1.11.0 (исключая)

EPSS

Процентиль: 15%

0.00047

Низкий

8.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-284

CWE-281

Связанные уязвимости

ELSA-2020-5766

oracle-oval

почти 5 лет назад

ELSA-2020-5766: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne security update (IMPORTANT)

ELSA-2020-5765