SB2020061058 - Multiple vulnerabilities in Runtime

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020061058

SB2020061058 - Multiple vulnerabilities in Runtime

Published: June 10, 2020 Updated: May 9, 2023

Security Bulletin ID SB2020061058
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Privilege Management (CVE-ID: CVE-2020-2023)

The vulnerability allows a local authenticated user to read and manipulate data.

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.


2) Link following (CVE-ID: CVE-2020-2026)

The vulnerability allows a local authenticated user to execute arbitrary code.

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.


Remediation

Install update from vendor's website.

References