GitHub Advisoryadvisory · Go

GHSA-877x-32pm-p28x Link Following in Kata Runtime

HIGH Published 2022-02-15 Modified 2021-05-13 Official page ↗
Aliases
CVE-2020-2026
Ecosystem
Go
Packages
github.com/kata-containers/runtime
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-59
Reviewed
2021-05-13

Affected packages

• Go github.com/kata-containers/runtime: < 1.9.1 → fixed in 1.9.1 • Go github.com/kata-containers/runtime: >= 1.10.0, < 1.10.6 → fixed in 1.10.6 • Go github.com/kata-containers/runtime: >= 1.11.0, < 1.11.1 → fixed in 1.11.1

Description

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

Related

Alias · CVE (1)

  • CVE-2020-2026 A malicious guest compromised before a container creation (e.g. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References