CVE-2020-2025
Last modified
CVE-2020-2025 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Katacontainers | Runtime | < 1.11.0 |
References
- https://github.com/kata-containers/runtime/pull/2487Patch, Third Party Advisory
- https://github.com/kata-containers/runtime/pull/2487Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-2025?
How severe is CVE-2020-2025?
How do I fix CVE-2020-2025?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-2024An improper link resolution vulnerability affects Kata Conta…6.5
- CVE-2020-20245Mikrotik RouterOs stable 6.46.3 suffers from a memory corrup…6.5
- CVE-2020-20246Mikrotik RouterOs stable 6.46.3 suffers from a memory corrup…6.5
- CVE-2020-20247Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a…6.5
- CVE-2020-20248Mikrotik RouterOs before stable 6.47 suffers from an uncontr…6.5
- CVE-2020-20249Mikrotik RouterOs before stable 6.47 suffers from a memory c…6.5
- CVE-2020-20250Mikrotik RouterOs before stable version 6.47 suffers from a …6.5
- CVE-2020-20252Mikrotik RouterOs before stable version 6.47 suffers from a …6.5
- CVE-2020-20253Mikrotik RouterOs before 6.47 (stable tree) suffers from a d…6.5
- CVE-2020-20254Mikrotik RouterOs before 6.47 (stable tree) suffers from a m…6.5
- CVE-2020-2026A malicious guest compromised before a container creation (e…8.8
- CVE-2020-20262Mikrotik RouterOs before 6.47 (stable tree) suffers from an …6.5
Are you affected by CVE-2020-2025?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST