Read the docs
TI-2020-01940 Aliases CVE-2020-2025

Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file

Priority LOW 38CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests.

Why it matters now

EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed Kata Containers (Kata Containers): 1.11.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
kata-containersKata Containersbefore 1.11.01.11.0Patch availableCNA
  • Kata Containers Vendorkata-containers Affected before 1.11.0 Fixed in 1.11.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:*before 1.11.0Vulnerablekata-containers
  • cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:* Versions before 1.11.0 Vulnerable ·kata-containers

Remediation

  • Fix · CNA Kata Containers (Kata Containers) Fixed in 1.11.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Kata Containers 1.11.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2020-01939 Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostPriority LOW 29
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2025

References

Patch 1

  • TI-2020-01941 Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path CVSS 3.1HIGH 8.8
  • TI-2020-01938 Kata Containers - Containers have access to the guest root filesystem device CVSS 3.1MEDIUM 6.3
  • TI-2020-01939 Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences