Vulnerability Description
An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on the worker nodes.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Katacontainers | Kata Containers | <= 1.11.3 |
References
- https://bugs.launchpad.net/katacontainers.io/+bug/1878234ExploitIssue TrackingThird Party Advisory
- https://github.com/kata-containers/kata-containers/releases/tag/2.0.0Third Party Advisory
- https://github.com/kata-containers/runtime/releases/tag/1.11.5Third Party Advisory
- https://github.com/kata-containers/runtime/releases/tag/1.12.0Third Party Advisory
- https://bugs.launchpad.net/katacontainers.io/+bug/1878234ExploitIssue TrackingThird Party Advisory
- https://github.com/kata-containers/kata-containers/releases/tag/2.0.0Third Party Advisory
- https://github.com/kata-containers/runtime/releases/tag/1.11.5Third Party Advisory
- https://github.com/kata-containers/runtime/releases/tag/1.12.0Third Party Advisory
FAQ
What is CVE-2020-27151?
CVE-2020-27151 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted acce...
How severe is CVE-2020-27151?
CVE-2020-27151 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-27151?
Check the references section above for vendor advisories and patch information. Affected products include: Katacontainers Kata Containers.