Filtered by vendor Katacontainers Subscriptions
Filtered by product Kata-containers Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-58354 1 Katacontainers 1 Kata-containers 2025-09-25 7.1 High
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0.
CVE-2020-28914 1 Katacontainers 1 Kata-containers 2024-11-21 7.1 High
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.