CVE-2020-2026: Link Following in Kata Runtime
Summary
CVE-2020-2026: Link Following in Kata Runtime. Affects github.com/kata-containers/runtime across 3 version ranges.
< 1.9.1
>= 1.10.0, < 1.10.6
>= 1.11.0, < 1.11.1
Fixed in 1.9.1, 1.10.6 or 1.11.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kata Runtime is a component of the Kata Containers project, which provides lightweight virtual machines (VMs) for running containers. It is implemented in Go and is responsible for managing the creation and execution of containers. The runtime allows users to isolate containers from the host system and provides a secure environment for running containerized applications. However, a vulnerability has been discovered in versions of the Kata Runtime prior to 1.11.1, 1.10.6, and 1.9.1, which could allow a malicious guest to mount the container filesystem on any host path, potentially leading to code execution on the host system.
Vulnerability Detail
The vulnerability, identified as CVE-2020-2026, arises from a flaw in the Kata Runtime's handling of container filesystems. A malicious guest, either through a compromised guest image or by running multiple containers, can exploit this flaw to trick the runtime into mounting the untrusted container filesystem on any host path. This could enable an attacker to execute arbitrary code on the host system, compromising its security and integrity. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.11.9.1go get github.com/kata-containers/runtime@v1.9.1 -
>= 1.10.0, < 1.10.61.10.6go get github.com/kata-containers/runtime@v1.10.6 -
>= 1.11.0, < 1.11.11.11.1go get github.com/kata-containers/runtime@v1.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by following the recommended fix and updating to the latest version of the Kata Runtime.
Conclusion
In conclusion, the CVE-2020-2026 vulnerability in the Kata Runtime exposes a significant security risk, allowing a malicious guest to mount the container filesystem on any host path and potentially execute arbitrary code on the host system. To mitigate this risk, it is crucial to update the Kata Runtime to the latest patched versions. Regularly updating and patching all software components is also recommended to minimize the risk of similar vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kata-containers/runtime →
FAQ
The vulnerability allows a malicious guest to mount the container filesystem on any host path, potentially leading to code execution on the host system. This can result in unauthorized access, data breaches, and compromise of the host's security and integrity.
Versions of the Kata Runtime prior to 1.11.1, 1.10.6, and 1.9.1 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is advisable to apply the recommended fix and update to the latest version of the Kata Runtime to mitigate the risk.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-877x-32pm-p28x/GHSA-877x-32pm-p28x.json
