LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28914: An improper file permissions vulnerability affects Kata Containers prior to 1.11.5.

An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Kata Containers before 1.11.5 could treat Kubernetes readonly hostPath mounts incorrectly. Files appeared readonly inside the container but remained writable inside the guest environment. In a breakout scenario, an attacker could change or delete host files that operators believed were protected.

Executive priority

Prioritize remediation where Kata Containers protects multi-tenant or sensitive Kubernetes workloads using hostPath mounts. Urgency is moderate because impact can affect host file integrity, but sources do not show active exploitation or CVSS severity.

Technical view

The issue affects Kata Containers prior to 1.11.5 when Kubernetes hostPath volumes mount files or directories as readonly. The container view enforces readonly, but the guest side can still write. The stated impact is modification or deletion of resources expected to be readonly during a container breakout situation.

Likely exposure

Exposure is most likely in Kubernetes environments running Kata Containers before 1.11.5 and using hostPath volumes mounted readonly. Environments not using Kata Containers, not using hostPath, or already on fixed releases are less likely exposed based on the bundle.

Exploitation context

The source bundle does not show KEV listing or active exploitation evidence. The described abuse depends on a malicious guest and a container breakout situation, so this is not presented as a standalone remote compromise path.

Researcher notes

Key evidence is configuration-specific: readonly hostPath mounts are readonly in-container but writable inside the guest. The CVE states potential impact in a breakout situation. No CWE, CVSS vector, exploit status, or detailed affected CPEs are provided in the bundle.

Mitigation direction

  • Upgrade Kata Containers runtime to 1.11.5 or later.
  • Review vendor release notes and related pull requests for deployment-specific guidance.
  • Reduce reliance on readonly hostPath mounts as a security boundary until upgraded.
  • Inventory Kubernetes workloads that use hostPath with readOnly settings.

Validation and detection

  • Identify Kata Containers runtime versions across Kubernetes nodes.
  • Find workloads using Kubernetes hostPath volumes with readOnly mounts.
  • Confirm upgraded nodes run 1.11.5 or later.
  • Validate operational assumptions for files expected to remain readonly.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-28914 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.