Description
A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kata Containers | Kata Containers | 1.11 – < 1.11.1, 1.10 – < 1.10.5, 1 – ≤ 1.9 | 1.11.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | istio +10 | 1.4.10-1.0.1.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kata | 1.7.3-1.0.7.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kata-image | 1.7.3-1.0.5.1.ol7_202007011859 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kata-runtime | 1.7.3-1.0.5.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kernel-uek-container | 4.14.35-1902.303.5.3.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kubeadm +2 | 1.14.9-1.0.6.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.2-6.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | olcnectl +4 | 1.0.5-3.el7 | ELSA-2020-5766, ELSA-2020-5765 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kata-containers/runtime | < 1.9.1 | 1.9.1 | GHSA-877x-32pm-p28x |
| Go | github.com/kata-containers/runtime | >= 1.10.0, < 1.10.6 | 1.10.6 | GHSA-877x-32pm-p28x |
| Go | github.com/kata-containers/runtime | >= 1.11.0, < 1.11.1 | 1.11.1 | GHSA-877x-32pm-p28x |
Advisories 2
- ELSA-2020-5765 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020
- ELSA-2020-5766 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020
References
- https://github.com/kata-containers/runtime/releases/tag/1.11.1
- https://github.com/kata-containers/runtime/releases/tag/1.10.5
- https://github.com/kata-containers/runtime/issues/2712
- https://github.com/kata-containers/runtime/pull/2713
- FEDORA-2020-7a0b6071a4 vendor-advisory
- FEDORA-2020-2f5879aeb6 vendor-advisory
- FEDORA-2020-c33083813d vendor-advisory
- FEDORA-2020-1af9cd8c87 vendor-advisory
- FEDORA-2020-61fcf3ffc7 vendor-advisory
- FEDORA-2020-15a1bde727 vendor-advisory