Description
An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kata Containers | Kata Containers | unspecified – < 1.11.0 | 1.11.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | istio +10 | 1.4.10-1.0.1.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kata | 1.7.3-1.0.7.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kata-image | 1.7.3-1.0.5.1.ol7_202007011859 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kata-runtime | 1.7.3-1.0.5.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kernel-uek-container | 4.14.35-1902.303.5.3.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kubeadm +2 | 1.14.9-1.0.6.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.2-6.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | olcnectl +4 | 1.0.5-3.el7 | ELSA-2020-5766, ELSA-2020-5765 |
Advisories 2
- ELSA-2020-5765 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020
- ELSA-2020-5766 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020