CVE-2020-2026

HIGH EPSS 37.5%
Published Jun 10, 20206y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Jun 10, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

CVSS Details

Base Score
8.8
Exploitability
2.0
Impact
6.0
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
37.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-59

Affected Products 4

VendorProductVersionRange
katacontainersruntime* ≤1.9
katacontainersruntime*≥1.10  –  <1.10.5
katacontainersruntime*≥1.11  –  <1.11.1
fedoraprojectfedora31any

References 10

  • github.com https://github.com/kata-containers/runtime/issues/2712
    Third Party Advisory
  • github.com https://github.com/kata-containers/runtime/pull/2713
    Third Party Advisory
  • github.com https://github.com/kata-containers/runtime/releases/tag/1.10.5
    Release NotesThird Party Advisory
  • github.com https://github.com/kata-containers/runtime/releases/tag/1.11.1
    Release NotesThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P7FHA4AF6Y6PAVJBTTQPUEHXZQUOF3P/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JPBKAQBF3OR72N55GWM2TDYQP2OHK6H/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6W5MKF7HSAIL2AX2BX6RV4WWVGUIKVLS/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJAMOVB7DSOGX7J26QH5HZKU7GSSX2VU/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNJHSSPCKUGJDVXXIXK2JUWCRJDQX7CE/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWACJQSMY5BVDMVTF3FBN7HZSOSFOG3Q/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.