CVE-2020-27151: An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted a...

Summary

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on the w...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
katacontainers	kata_containers	<= 1.11.3 2.0.0 `cpe:2.3:a:katacontainers:kata_containers::::::::`

Original advisory text

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted a...

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on the worker nodes.

References

https://bugs.launchpad.net/katacontainers.io/+bug/1878234 Exploit Issue Tracking Third Party Advisory
https://github.com/kata-containers/kata-containers/releases/tag/2.0.0 Third Party Advisory
https://github.com/kata-containers/runtime/releases/tag/1.11.5 Third Party Advisory
https://github.com/kata-containers/runtime/releases/tag/1.12.0 Third Party Advisory