Kata Containers
Monthly
Host root code execution in Kata Containers kata-runtime prior to 4.0.0 lets a pod user escape the guest VM boundary by abusing the unvalidated 'io.katacontainers.config_path' pod annotation, which caused the runtime to load an arbitrary host TOML configuration file without restriction. Because that config selects the hypervisor and virtio-fs daemon binaries, an attacker who can both set the annotation and drop a file at a host-visible path can point the runtime at an attacker-controlled binary and have it executed as root on the host, collapsing the security isolation Kata exists to provide (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis, but the fix (removal of the annotation in version 4.0.0) is confirmed by the vendor GHSA advisory and commit.
Arbitrary file write in Kata Containers v3.4.0 to v3.28.0 allows untrusted hosts to overwrite binaries and exfiltrate data from guest workloads, including those in confidential VMs (CVMs). The vulnerability stems from inadequate validation in the CopyFile policy, permitting host-initiated writes to arbitrary paths inside guest images. This enables binary replacement for code execution or data theft across the trust boundary. Patched in v3.29.0. EPSS data not available; no active exploitation confirmed at time of analysis.
Privilege escalation in Kata Containers (versions prior to 3.27.0) running on the Cloud Hypervisor backend lets a sufficiently-privileged container user write to the guest micro-VM's root filesystem and gain arbitrary code execution as root inside that VM. The root cause is that the read-only DAX/virtio-pmem rootfs image is never actually enforced read-only, so guest writes to /dev/pmem0 are observed by the guest. Publicly available exploit detail exists (GitHub Security Advisory GHSA-wwj6-vghv-5p64), though EPSS exploitation probability is negligible (0.01%) and it is not on CISA KEV.
Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security guarantee of hardware-isolated containers. PoC and patch available.
Authorization bypass in the kata-agent's ttRPC API allows an untrusted host to invoke two mem-agent methods unconditionally, circumventing the OPA/Rego-based AgentPolicy that forms the security boundary in Confidential Containers (CoCo) deployments. Affected are kata-containers versions prior to 4.0.0 when the mem-agent feature is explicitly enabled (disabled by default). The untrusted host can force in-guest memory operations - swap, aggressive eviction, or compaction - causing attacker-controlled availability and performance degradation of the confidential workload; the description explicitly rules out memory disclosure and code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the bypass is architecturally significant because it violates the CoCo threat model's fundamental assumption that the host is untrusted.
An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Host root code execution in Kata Containers kata-runtime prior to 4.0.0 lets a pod user escape the guest VM boundary by abusing the unvalidated 'io.katacontainers.config_path' pod annotation, which caused the runtime to load an arbitrary host TOML configuration file without restriction. Because that config selects the hypervisor and virtio-fs daemon binaries, an attacker who can both set the annotation and drop a file at a host-visible path can point the runtime at an attacker-controlled binary and have it executed as root on the host, collapsing the security isolation Kata exists to provide (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis, but the fix (removal of the annotation in version 4.0.0) is confirmed by the vendor GHSA advisory and commit.
Arbitrary file write in Kata Containers v3.4.0 to v3.28.0 allows untrusted hosts to overwrite binaries and exfiltrate data from guest workloads, including those in confidential VMs (CVMs). The vulnerability stems from inadequate validation in the CopyFile policy, permitting host-initiated writes to arbitrary paths inside guest images. This enables binary replacement for code execution or data theft across the trust boundary. Patched in v3.29.0. EPSS data not available; no active exploitation confirmed at time of analysis.
Privilege escalation in Kata Containers (versions prior to 3.27.0) running on the Cloud Hypervisor backend lets a sufficiently-privileged container user write to the guest micro-VM's root filesystem and gain arbitrary code execution as root inside that VM. The root cause is that the read-only DAX/virtio-pmem rootfs image is never actually enforced read-only, so guest writes to /dev/pmem0 are observed by the guest. Publicly available exploit detail exists (GitHub Security Advisory GHSA-wwj6-vghv-5p64), though EPSS exploitation probability is negligible (0.01%) and it is not on CISA KEV.
Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security guarantee of hardware-isolated containers. PoC and patch available.
Authorization bypass in the kata-agent's ttRPC API allows an untrusted host to invoke two mem-agent methods unconditionally, circumventing the OPA/Rego-based AgentPolicy that forms the security boundary in Confidential Containers (CoCo) deployments. Affected are kata-containers versions prior to 4.0.0 when the mem-agent feature is explicitly enabled (disabled by default). The untrusted host can force in-guest memory operations - swap, aggressive eviction, or compaction - causing attacker-controlled availability and performance degradation of the confidential workload; the description explicitly rules out memory disclosure and code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the bypass is architecturally significant because it violates the CoCo threat model's fundamental assumption that the host is untrusted.
An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.