A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2026
Reference (s):
- FEDORA:FEDORA-2020-15a1bde727
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P7FHA4AF6Y6PAVJBTTQPUEHXZQUOF3P/
- FEDORA:FEDORA-2020-1af9cd8c87
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWACJQSMY5BVDMVTF3FBN7HZSOSFOG3Q/
- FEDORA:FEDORA-2020-2f5879aeb6