CVE-2020-2023: Kata Containers - Containers have access to the guest root filesystem device
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kata Containersto a version that resolves this vulnerability.Fixed in 1.11.1 - Upgrade
Upgrade
Kata Containersto a version that resolves this vulnerability.Fixed in 1.10.5
Event History
Frequently Asked Questions
What is CVE-2020-2023?
CVE-2020-2023 is a vulnerability in Kata Containers that allows malicious containers to gain code execution on the guest system.
What is the severity of CVE-2020-2023?
The severity of CVE-2020-2023 is rated as medium with a CVSS score of 6.3.
How does CVE-2020-2023 affect Kata Containers versions?
CVE-2020-2023 affects Kata Containers versions 1.9, 1.10 (up to 1.10.5), and 1.11 (up to 1.11.1).
What is the CWE associated with CVE-2020-2023?
The CWE associated with CVE-2020-2023 is CWE-250.
How can I mitigate CVE-2020-2023 in Kata Containers?
To mitigate CVE-2020-2023, users should update their Kata Containers runtime to version 1.11.1 or later.