Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers
Date: 2022-02
Affected: go/github.com/kata-containers/runtime, go/github.com/kata-containers/runtime, go/github.com/kata-containers/runtime
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2020-2023
CWE: CWE-250
CWE-269
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.


Mitigations:

Architectural layers (MAESTRO):