CVE-2020-2023 Kata Containers - Containers have access to the guest root filesystem device
Malicious containers can access the guest root filesystem to execute code and impersonate the kata-agent, requiring an upgrade to secure the environment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-2023?
CVE-2020-2023 is a low-severity vulnerability in Kata Containers, published on 10 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
Weakness: CWE-250
Which versions are affected by CVE-2020-2023?
12 open source packages ship an affected version, including github.com/kata-containers/agent and github.com/kata-containers/runtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kata-containers/agent Go | All versions | 1.9.1 |
github.com/kata-containers/agent Go | All versions | 1.9.1 |
github.com/kata-containers/agent Go | From 1.10.0 | 1.10.5 |
github.com/kata-containers/agent Go | From 1.10.0 | 1.10.5 |
github.com/kata-containers/agent Go | From 1.11.0 | 1.11.1 |
github.com/kata-containers/agent Go | From 1.11.0 | 1.11.1 |
6 more packages
github.com/kata-containers/runtime Go | All versions | 1.9.1 |
github.com/kata-containers/runtime Go | All versions | 1.9.1 |
github.com/kata-containers/runtime Go | From 1.10.0 | 1.10.5 |
github.com/kata-containers/runtime Go | From 1.10.0 | 1.10.5 |
github.com/kata-containers/runtime Go | From 1.11.0 | 1.11.1 |
github.com/kata-containers/runtime Go | From 1.11.0 | 1.11.1 |
Products include Katacontainers Runtime.
How do I fix CVE-2020-2023?
Upgrade github.com/kata-containers/agent to a fixed version for your release line: 1.9.1, 1.10.5 or 1.11.1.
Is CVE-2020-2023 being exploited?
There is no known exploitation of CVE-2020-2023 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Kata Containers
Sources
Also known as GHSA-6978-vg2j-cc9q.