CVE-2020-2025

HIGH

Kata Containers runtime < 1.11.0 - Unauthenticated Guest-to-Host Filesystem Overwrite via Image Persistence

Title source: llm
STIX 2.1

Description

Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.

References (1)

Core 1
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/kata-containers/runtime/pull/2487

Scores

CVSS v3 8.8
EPSS 0.0031
EPSS Percentile 22.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-284 CWE-281
Status published
Products (1)
katacontainers/runtime < 1.11.0
Published May 19, 2020
Tracked Since Feb 18, 2026