A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5765 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

  - An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container     teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all     mount points underneath it, potentiality resulting in a host DoS. (CVE-2020-2024)

  - Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying     image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent     guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect     QEMU and Firecracker based guests. (CVE-2020-2025)

  - A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running     multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any     host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11     versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and     earlier versions. (CVE-2020-2026)

  - The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account     for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by     kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod.
    If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node     and cause the node to fail. (CVE-2020-8557)

  - A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all     versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens     and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio     configuration. (CVE-2020-1764)

  - The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6     are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to     escalate privileges from a node compromise to a full cluster compromise. (CVE-2020-8559)

  - Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry     v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception     resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a     null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a     null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default     in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy     sidecar, triggering a denial of service. (CVE-2020-10739)

  - In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would     incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with     a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only     allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and     validating a server TLS certificate for upstream connections. This vulnerability is only applicable to     situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which     you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com,     and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are     vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use     match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6,     1.13.4, 1.14.4, 1.15.0. (CVE-2020-15104)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5766 advisory.

  - An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container     teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all     mount points underneath it, potentiality resulting in a host DoS. (CVE-2020-2024)

  - Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying     image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent     guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect     QEMU and Firecracker based guests. (CVE-2020-2025)

  - A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running     multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any     host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11     versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and     earlier versions. (CVE-2020-2026)

  - The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account     for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by     kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod.
    If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node     and cause the node to fail. (CVE-2020-8557)

  - The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6     are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to     escalate privileges from a node compromise to a full cluster compromise. (CVE-2020-8559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2020-2026

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for [PUT CVEs HERE]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180974	Oracle Linux 7 : Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne (ELSA-2020-5765)	Nessus	Oracle Linux Local Security Checks	high
180954	Oracle Linux 7 : Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne (ELSA-2020-5766)	Nessus	Oracle Linux Local Security Checks	high
142586	Fedora 31 : kata-ksm-throttler (2020-15a1bde727)	Nessus	Fedora Local Security Checks	high
142564	Fedora 31 : kata-osbuilder (2020-61fcf3ffc7)	Nessus	Fedora Local Security Checks	high
142527	Fedora 31 : kata-shim (2020-1af9cd8c87)	Nessus	Fedora Local Security Checks	high
141524	Fedora 31 : kata-runtime (2020-7a0b6071a4)	Nessus	Fedora Local Security Checks	high
141520	Fedora 31 : kata-proxy (2020-2f5879aeb6)	Nessus	Fedora Local Security Checks	high
141519	Fedora 31 : kata-agent (2020-c33083813d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-2026

high

Tenable Plugins

high

high

high

high

high

high

high

high