[kata-dev] KCSA: impact of CVE-2019-5736 on Kata Containers

Tao Peng bergwolf at hyper.sh
Mon Feb 25 05:51:43 UTC 2019

Hi Kata devs/users:

We have just published the first KCSA (Kata Containers Security
Advisories) about the impact of cve-2019-5736 on Kata Containers.

The CVE-2019-5736 does not affect Kata Containers. Kata Containers
does use the runc libcontainer library as part of its 'kata-agent' to
launch container workloads, but the kata-agent executable is a
permanently running application within the Kata Containers VM. Thus,
the exit/re-execute cycle utilised by CVE-2019-5736 to execute the
injected code is never undertaken.

It should be noted, if the exploit had escaped from the kata-agent,
the exploit code would have been executing inside the Kata Containers
VM as root, and would not have direct access to either the host system
or other container/pods.

It is highly likely Kata Containers will vendor in and adopt all
relevant libcontainer updates and changes, but given the 'copying'
nature of some fixes, a performance and resource impact review will be

For details about the KCSA, please see

bergwolf at hyper.sh

More information about the kata-dev mailing list