Hi Kata devs/users: We have just published the first KCSA (Kata Containers Security Advisories) about the impact of cve-2019-5736 on Kata Containers. The CVE-2019-5736 does not affect Kata Containers. Kata Containers does use the runc libcontainer library as part of its 'kata-agent' to launch container workloads, but the kata-agent executable is a permanently running application within the Kata Containers VM. Thus, the exit/re-execute cycle utilised by CVE-2019-5736 to execute the injected code is never undertaken. It should be noted, if the exploit had escaped from the kata-agent, the exploit code would have been executing inside the Kata Containers VM as root, and would not have direct access to either the host system or other container/pods. It is highly likely Kata Containers will vendor in and adopt all relevant libcontainer updates and changes, but given the 'copying' nature of some fixes, a performance and resource impact review will be undertaken. For details about the KCSA, please see https://github.com/kata-containers/community/blob/master/VMT/KCSA/KCSA-CVE-2... Cheers, Tao -- bergwolf@hyper.sh