CVE-2020-2023

Katalog CVE

CVSS 6.3 · Medium EPSS 1,1%

Kerentanan Execution with Unnecessary Privileges pada katacontainers runtime. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

Rincian

Terbit di NVD

10 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kata-containers/agent/pull/792 patch
• https://github.com/kata-containers/runtime/issues/2488 patch · advisory pihak ketiga
• https://github.com/kata-containers/runtime/pull/2477 patch · advisory pihak ketiga
• https://github.com/kata-containers/runtime/pull/2487 patch · advisory pihak ketiga
• https://github.com/kata-containers/agent/issues/791 advisory pihak ketiga
• https://github.com/kata-containers/runtime/releases/tag/1.10.5 release notes · advisory pihak ketiga
• https://github.com/kata-containers/runtime/releases/tag/1.11.1 release notes · advisory pihak ketiga