x/vulndb: potential Go vuln in github.com/kata-containers/runtime: CVE-2020-2024

[tatianab]

CVE-2020-2024 references github.com/kata-containers/runtime, which may be a Go module.

Description:
An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-2024
• report: harden container hostpath cleanup kata-containers/runtime#2474
• fix: vc: do not follow symlink when umounting contanier host path kata-containers/runtime#2475
• Imported by: https://pkg.go.dev/github.com/kata-containers/runtime?tab=importedby

Cross references:

• Module github.com/kata-containers/runtime appears in issue x/vulndb: potential Go vuln in github.com/kata-containers/runtime: GHSA-6978-vg2j-cc9q #801 NOT_IMPORTABLE
• Module github.com/kata-containers/runtime appears in issue x/vulndb: potential Go vuln in github.com/kata-containers/runtime: GHSA-877x-32pm-p28x #811 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/kata-containers/runtime
      vulnerable_at: 0.0.0-20210505125100-04f29832a923
      packages:
        - package: Kata Containers
cves:
    - CVE-2020-2024
credits:
    - Yuval Avrahami, Palo Alto Networks
references:
    - report: https://github.com/kata-containers/runtime/issues/2474
    - fix: https://github.com/kata-containers/runtime/pull/2475

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports