CVE-2020-2023 : Security Advisory and Response

Kata Containers have a vulnerability that allows containers to access the guest root filesystem device, potentially leading to code execution and masquerading as the kata-agent.

Understanding CVE-2020-2023

This CVE affects Kata Containers versions 1.11, 1.10, and 1.9, allowing malicious containers to exploit the guest's root filesystem device.

What is CVE-2020-2023?

Kata Containers do not restrict container access to the guest's root filesystem device, enabling malicious containers to execute code on the guest and impersonate the kata-agent.

The Impact of CVE-2020-2023

CVSS Base Score: 3.8 (Low)
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
Integrity Impact: Low
Scope: Changed
This vulnerability does not impact confidentiality or availability.

Technical Details of CVE-2020-2023

This section provides detailed technical information about the vulnerability.

Vulnerability Description

Containers in Kata Containers can access the guest's root filesystem device, allowing for potential code execution and impersonation as the kata-agent.

Affected Systems and Versions

Kata Containers 1.11 versions earlier than 1.11.1
Kata Containers 1.10 versions earlier than 1.10.5
Kata Containers 1.9 and earlier versions

Exploitation Mechanism

Affects QEMU and Cloud Hypervisor guests on default configuration
Does not affect initrd (initramfs) based guests
Requires the container to have CAP_SYS_MKNOD
Default in Docker and Kubernetes with containerd, but not in Kubernetes with CRI-O

Mitigation and Prevention

Protect your systems from CVE-2020-2023 with the following steps:

Immediate Steps to Take

Update Kata Containers to versions 1.11.1, 1.10.5, or newer
Restrict container access to critical filesystem devices
Monitor container activities for suspicious behavior

Long-Term Security Practices

Implement least privilege access for containers
Regularly audit and update container security configurations
Educate users on secure container practices

Patching and Updates

Apply security patches promptly
Stay informed about Kata Containers security advisories