Open Stack

Hi Kata devs/users:

We have just published the first KCSA (Kata Containers Security
Advisories) about the impact of cve-2019-5736 on Kata Containers.

The CVE-2019-5736 does not affect Kata Containers. Kata Containers
does use the runc libcontainer library as part of its 'kata-agent' to
launch container workloads, but the kata-agent executable is a
permanently running application within the Kata Containers VM. Thus,
the exit/re-execute cycle utilised by CVE-2019-5736 to execute the
injected code is never undertaken.

It should be noted, if the exploit had escaped from the kata-agent,
the exploit code would have been executing inside the Kata Containers
VM as root, and would not have direct access to either the host system
or other container/pods.

It is highly likely Kata Containers will vendor in and adopt all
relevant libcontainer updates and changes, but given the 'copying'
nature of some fixes, a performance and resource impact review will be
undertaken.

For details about the KCSA, please see
https://github.com/kata-containers/community/blob/master/VMT/KCSA/KCSA-CVE-2019-5736.md

Cheers,
Tao
-- 
bergwolf at hyper.sh