Description
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kata | 1.7.3-1.0.12.el7 | ELSA-2021-9029, ELSA-2021-9028 |
| Oracle Linux 7 | kata-image | 1.11.5-1.1.ol8_202101151826 | ELSA-2021-9028 |
| Oracle Linux 7 | kata-runtime | 1.7.3-1.0.7.el7 | ELSA-2021-9029, ELSA-2021-9028 |
| Oracle Linux 7 | kata-shim +3 | 1.11.5-1.el8 | ELSA-2021-9028 |
| Oracle Linux 7 | kubeadm +2 | 1.17.9-1.0.6.el7 | ELSA-2021-9029, ELSA-2021-9028 |
| Oracle Linux 7 | olcnectl +6 | 1.1.10-1.el7 | ELSA-2021-9029, ELSA-2021-9028 |
Advisories 2
- ELSA-2021-9028 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 10, 2021
- ELSA-2021-9029 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 10, 2021