CVE-2020-28914

HIGH Year: 2020
CVSS v3 Score
7.1
High
CVSS v2 Score
3.6
Low
Weakness Type
CWE-732
View all →

Vulnerability Description

An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.

Related Vulnerabilities

CVE-2001-0006

HIGH
CVSS:7.1(High)

The Winsock2ProtocolCatalogMutex mutex in Windows NT 4.0 has inappropriate Everyone/Full Control permissions, which allows local users to modify the permissions to "No Access" and disable Winsock netw...

CWE-7322001

CVE-2004-1714

HIGH
CVSS:7.1(High)

BlackICE PC Protection and Server Protection installs (1) firewall.ini, (2) blackice.ini, (3) sigs.ini and (4) protect.ini with Everyone Full Control permissions, which allows local users to cause a d...

CWE-7322004

CVE-2005-4868

HIGH
CVSS:7.1(High)

Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group, which allows local users to gain unauthorized access, gain sensitive information, su...

CWE-7322005

CVE-2009-3611

HIGH
CVSS:7.1(High)

common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive inform...

CWE-7322009

CVE-2009-3939

HIGH
CVSS:7.1(High)

The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying th...

CWE-7322009

CVE-2017-18284

HIGH
CVSS:7.1(High)

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to thi...

CWE-7322017