Link following in Runtime - CVE-2020-2026
Published: June 10, 2020 / Updated: August 8, 2020
Vulnerability identifier: #VU34360
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2020-2026
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to execute arbitrary code.
A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Affected software
Runtime
Fedora
kata-proxy
kata-agent
kata-shim
kata-ksm-throttler
kata-osbuilder
kata-runtime
Fedora
kata-proxy
kata-agent
kata-shim
kata-ksm-throttler
kata-osbuilder
kata-runtime
How to mitigate CVE-2020-2026
Install update from vendor's website.
Runtime - update to 1.11.1
kata-proxy - update to 1.11.1-1.fc31.1
kata-agent - update to 1.11.1-1.fc31.1
kata-shim - update to 1.11.1-1.fc31.1
kata-ksm-throttler - update to 1.11.1-1.fc31.1
kata-osbuilder - update to 1.11.1-1.fc31.1
kata-runtime - update to 1.11.1-3.fc31
kata-proxy - update to 1.11.1-1.fc31.1
kata-agent - update to 1.11.1-1.fc31.1
kata-shim - update to 1.11.1-1.fc31.1
kata-ksm-throttler - update to 1.11.1-1.fc31.1
kata-osbuilder - update to 1.11.1-1.fc31.1
kata-runtime - update to 1.11.1-3.fc31