CoreOS rkt rkt enter Command Unauthorized Access Vulnerability

By GIXnews


A vulnerability in CoreOS rkt could allow an authenticated, local attacker to gain unauthorized access to sensitive resources on a targeted host system.

The vulnerability exists because the affected software does not isolate processes in containers that are run with the rkt enter command. Processes that are run with the rkt enter command are not limited by cgroups during stage 2, the actual environment in which applications run. An attacker could exploit this vulnerability by executing the rkt enter command on a targeted host system. A successful exploit could allow the attacker to gain unauthorized access to resources on the system, which could be used to conduct further attacks.

Proof-of-concept code that demonstrates an exploit of this vulnerability is available.

CoreOS has confirmed the vulnerability; however, software updates are not available.

Security Impact Rating: High

CVE: CVE-2019-10147

Source:: Cisco Multivendor Vulnerability Alerts