x/vulndb: potential Go vuln in github.com/kata-containers/kata-containers: CVE-2020-28914

[tatianab]

CVE-2020-28914 references github.com/kata-containers/kata-containers, which may be a Go module.

Description:
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-28914
• fix: runtime: readonly volume should be bind mounted readonly on the host kata-containers/kata-containers#1062
• fix: readonly volume should be bind mounted readonly on the host kata-containers/runtime#3042
• fix: Backports: Read-only mount fixes for 1.11 kata-containers/runtime#3051
• web: https://github.com/kata-containers/runtime/releases/tag/1.12.0
• web: https://github.com/kata-containers/runtime/releases/tag/1.11.5
• Imported by: https://pkg.go.dev/github.com/kata-containers/kata-containers?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/kata-containers/kata-containers
      vulnerable_at: 0.0.0-20231108201404-268d4d622fed
      packages:
        - package: n/a
cves:
    - CVE-2020-28914
references:
    - fix: https://github.com/kata-containers/kata-containers/pull/1062
    - fix: https://github.com/kata-containers/runtime/pull/3042
    - fix: https://github.com/kata-containers/runtime/pull/3051
    - web: https://github.com/kata-containers/runtime/releases/tag/1.12.0
    - web: https://github.com/kata-containers/runtime/releases/tag/1.11.5

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports