Security readout for executives and security teams
Plain-English summary
CVE-2020-2024 can let a malicious Kata Containers guest cause the host to unmount arbitrary mount points during container teardown. The business impact is denial of service, not data theft, but it can disrupt workloads sharing that host.
Executive priority
Treat this as a moderate operational risk. It is unlikely to expose confidential data, but vulnerable multi-tenant hosts can suffer workload disruption. Remediate during normal security maintenance, faster where host availability is business-critical.
Technical view
Kata Containers before 1.11.0 has an improper link resolution issue, mapped to CWE-59. During teardown, kata-runtime may follow attacker-influenced links and unmount a host mount point and mounts underneath it, causing high availability impact.
Likely exposure
Exposure is likely limited to systems running Kata Containers versions before 1.11.0, especially hosts running untrusted or multi-tenant guest workloads. The source bundle does not identify specific distributions, cloud services, or downstream packages.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. The CVE is not listed as KEV in the supplied data, and no cited source establishes active exploitation.
Researcher notes
Key evidence is the CVE description, CVSS vector, CWE-59 classification, and upstream issue/PR references. The supplied affected version data is broad, so confirm downstream package status before declaring systems fixed or vulnerable.
Mitigation direction
- Upgrade Kata Containers/runtime to version 1.11.0 or later where applicable.
- Check vendor or distribution advisories for backported fixes.
- Reduce placement of untrusted workloads on vulnerable Kata hosts.
- Monitor host mount state changes around container teardown events.
- Prioritize remediation on multi-tenant or availability-sensitive hosts.
Validation and detection
- Inventory Kata Containers and kata-runtime versions across container hosts.
- Confirm affected hosts are not running versions prior to 1.11.0.
- Review runtime teardown logs for unexpected unmount behavior.
- Validate staging teardown does not disturb unrelated host mounts.
- Check package vendor notes for patched backport version numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-2024 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H24Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kata-containers/runtime/issues/2474CVE reference · x_refsource_MISC
- https://github.com/kata-containers/runtime/pull/2475CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.