Executive brief
Kata Containers is a tool used to run applications in secure, isolated virtual machines. A vulnerability was found that allows a user inside a container to modify the underlying virtual machine's file system. This could allow an attacker to take full control of the virtual machine, though it does not directly allow them to access the main host computer or other users' data.
Technical details
The vulnerability stems from how Kata Containers utilizes virtio-pmem with DAX-mapping for the guest root filesystem. In the Linux kernel, the virtio-pmem probe path fails to mark memory regions as read-only, leaving the block device writable. While Cloud Hypervisor uses MAP_PRIVATE to prevent changes from persisting to the host's backing file, the guest kernel and hypervisor still observe these copy-on-write modifications. An attacker with CAP_MKNOD permissions inside a container can create a device node for /dev/pmem0, calculate filesystem offsets, and overwrite guest binaries (e.g., systemd-tmpfiles) to achieve root execution within the guest micro VM. This issue is patched in version 0.0.0-20260219090056-6a672503973b.
Affected products
- Kata Containers Kata Containers < 0.0.0-20260219090056-6a672503973b
Timeline
- 2026-02-19: disclosed
- 2026-02-19: advisory
- 2026-02-19: patched