Vulnerability-Lookup

CVE-2026-47243 (GCVE-0-2026-47243)

Vulnerability from cvelistv5 – Published: 2026-08-07 21:36 – Updated: 2026-08-10 13:34

Title

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Summary

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process's mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-36 - Absolute Path Traversal

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/kata-containers/kata-container…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
kata-containers	kata-containers	Affected: < 3.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-07T22:17:12.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/21/14"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47243",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T13:33:45.456561Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T13:34:09.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kata-containers",
          "vendor": "kata-containers",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process\u0027s mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-36",
              "description": "CWE-36: Absolute Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T21:36:49.979Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227"
        }
      ],
      "source": {
        "advisory": "GHSA-2gv2-cffp-j227",
        "discovery": "UNKNOWN"
      },
      "title": "Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47243",
    "datePublished": "2026-08-07T21:36:49.979Z",
    "dateReserved": "2026-05-18T22:54:18.272Z",
    "dateUpdated": "2026-08-10T13:34:09.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47243",
      "date": "2026-08-10",
      "epss": "0.00181",
      "percentile": "0.07795"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-09T01:02:08.000Z",
      "cve": "CVE-2026-47243",
      "id": "msrc_CVE-2026-47243",
      "initial_release_date": "2026-08-09T01:02:08.000Z",
      "product_status:under_investigation": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-47243.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-47243\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-07T22:16:58.753\",\"lastModified\":\"2026-08-10T14:17:24.147\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process\u0027s mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"kata-containers\",\"product\":\"kata-containers\",\"versions\":[{\"version\":\"\u003c 3.31.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-10T13:33:45.456561Z\",\"id\":\"CVE-2026-47243\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-36\"}]}],\"references\":[{\"url\":\"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227\",\"source\":\"security-advisories@github.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/21/14\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-08T23:29:48Z",
      "cve": "CVE-2026-47243",
      "id": "CVE-2026-47243",
      "initial_release_date": "2026-07-30T16:44:56Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-47243",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-47243.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-22\", \"lang\": \"en\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-36\", \"lang\": \"en\", \"description\": \"CWE-36: Absolute Path Traversal\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 9.2, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227\"}], \"affected\": [{\"vendor\": \"kata-containers\", \"product\": \"kata-containers\", \"versions\": [{\"version\": \"\u003c 3.31.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-07T21:36:49.979Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process\u0027s mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0.\"}], \"source\": {\"advisory\": \"GHSA-2gv2-cffp-j227\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/21/14\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-08-07T22:17:12.604Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-47243\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-10T13:33:45.456561Z\"}}}], \"references\": [{\"url\": \"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-10T13:34:04.571Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-47243\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-05-18T22:54:18.272Z\", \"datePublished\": \"2026-08-07T21:36:49.979Z\", \"dateUpdated\": \"2026-08-10T13:34:09.469Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-2GV2-CFFP-J227

Vulnerability from github – Published: 2026-05-27 22:50 – Updated: 2026-05-27 22:50

Summary

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Details

Summary

In the runtime-rs standalone virtio-fs path, verified here with QEMU (and verified with Cloud Hypervisor too), Kata Containers runs host virtiofsd as root with:

--sandbox none --seccomp none

If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE requests directly to the host virtiofsd. With the tested runtime-rs virtio-fs configuration, a raw FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the virtio-fs shared directory.

This lets guest root create host-root owned symlinks in sensitive host paths. The PoC created here will create symlinks in the host /etc/cron.d directory, causing host cron to execute a guest-controlled payload as host root.

Impact: guest root can execute code as host root.

Affected configuration

The verified host used:

/opt/kata/share/defaults/kata-containers/runtime-rs/configuration-qemu-runtime-rs.toml

rootless = false
shared_fs = "virtio-fs"
virtio_fs_daemon = "/opt/kata/libexec/virtiofsd"
hypervisor_name = "qemu"
debug_console_enabled = false

Pinned upstream references, using Kata Containers main commit 2ffd1538a296cff93a357bfba0dfca747480a1f8:

runtime-rs standalone virtio-fs adds --sandbox none --seccomp none to the virtiofsd command line.
runtime-rs QEMU leaves rootless mode disabled by default: rootless = false.
The QEMU runtime-rs config template generates an installed config that uses standalone virtio-fs and points runtime-rs at the host virtiofsd binary: shared_fs and virtio_fs_daemon.
The runtime-rs Makefile resolves those placeholders to virtio-fs and $(LIBEXECDIR)/virtiofsd.
runtime-rs selects the same standalone virtio-fs implementation whenever shared_fs = "virtio-fs": ShareVirtioFsStandalone.

Details

The guest kernel normally owns the virtio-fs client. A normal guest process will use filesystem syscalls, and the guest kernel will validate the paths, and only then does the kernel send FUSE messages to the host backend.

An attacker with root-equivalent access inside the guest can bypass that guest virtio-fs client. They can access the virtio-fs PCI device, mmap the virtio PCI BAR, recover guest physical addresses from /proc/self/pagemap, and build their own virtqueue from userspace. That queue can submit attacker-built FUSE messages directly to host virtiofsd.

The relevant primitive is FUSE_SYMLINK. An attacker can send a request whose body contains:

new symlink name: /etc/cron.d/kata-go-escape-cron-<pid>
symlink target: /proc/<pid>/root/run/kata-containers/shared/sandboxes/<sid>/ro/passthrough/<sid>/rootfs/tmp/kata-go-escape-payload

The new symlink name is an absolute host path. virtiofsd should reject that request or force it to resolve below the configured --shared-dir. In the tested runtime-rs path, host-root unsandboxed virtiofsd accepts the absolute name, creating a real host symlink under /etc/cron.d.

The attacker can make the symlink target resolve through /proc/<pid>/root/... for a live Kata runtime process whose mount namespace can see the guest-created payload. One matching runtime PID is enough.

When the host cron reads /etc/cron.d, it follows the root-owned symlink, loads the guest-created crontab payload, and executes it as host root.

PoC

sudo timeout --foreground --kill-after=10s 600s ctr run --rm \
  --runtime /opt/kata/runtime-rs/bin/containerd-shim-kata-v2 \
  --runtime-config-path /opt/kata/share/defaults/kata-containers/runtime-rs/configuration-qemu-runtime-rs.toml \
  --privileged \
  --privileged-without-host-devices \
  docker.io/library/kata-go-escape:local \
  "$run_id"

The container is privileged only to model the post-escape condition where the attacker already has guest-root capabilities. It is not the vulnerability by itself.

Inside the guest, the PoC:

Writes a cron payload to guest /tmp/kata-go-escape-payload.
Finds the virtio-fs PCI device in guest /sys.
Takes over a virtio-fs queue from userspace.
Sends FUSE_INIT.
Discovers the current runtime-rs sandbox under passthrough/.
Looks up passthrough/<sid>/rootfs/tmp/kata-go-escape-payload.
Sends raw FUSE_SYMLINK requests where the new symlink names are absolute host paths under /etc/cron.d.
Keeps the guest alive while host cron scans.

Example log lines:

[guest] virtio-fs PCI device: /sys/devices/pci0000:00/0000:00:05.0
[res] sandbox_id=kata-go-escape-test-1778522686-1539
[res] lookup_path_error=0 path=passthrough/kata-go-escape-test-1778522686-1539/rootfs/tmp/kata-go-escape-payload nodeid=21
[spray] pid=1 err=-2 created_candidates=1

err=-2 is expected for the symlink spray. virtiofsd can return ENOENT after the side effect because its follow-up lookup is still relative to the export root. The host symlink creation has already happened.

Impact

The PoC proves guest-root to host-root command execution.

Verified host proof:

/run/kata-go-escape.proof

uid=0(root) gid=0(root) groups=0(root)
Mon May 11 18:05:01 UTC 2026

The proof file is written in host /run by host cron. It is not written by the guest process and not written by virtiofsd.

An attacker who reaches guest root can therefore cross the Kata isolation boundary and execute commands as host root on affected runtime-rs virtio-fs deployments.

Severity

8.4 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kata-containers/kata-containers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260519062212-ffa59ce3aa78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47243"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-36"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-27T22:50:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nIn the runtime-rs standalone virtio-fs path, verified here with QEMU (and verified with Cloud Hypervisor too), Kata Containers runs host `virtiofsd` as root with:\n\n```\n--sandbox none --seccomp none\n```\n\nIf an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE requests directly to the host `virtiofsd`. With the tested runtime-rs virtio-fs configuration, a raw `FUSE_SYMLINK` request whose new symlink name is an absolute host path is honored outside the virtio-fs shared directory.\n\nThis lets guest root create host-root owned symlinks in sensitive host paths. The PoC created here will create symlinks in the host `/etc/cron.d` directory, causing host cron to execute a guest-controlled payload as host root.\n\nImpact: guest root can execute code as host root.\n\n### Affected configuration\n\nThe verified host used:\n\n```\n/opt/kata/share/defaults/kata-containers/runtime-rs/configuration-qemu-runtime-rs.toml\n\nrootless = false\nshared_fs = \"virtio-fs\"\nvirtio_fs_daemon = \"/opt/kata/libexec/virtiofsd\"\nhypervisor_name = \"qemu\"\ndebug_console_enabled = false\n```\n\nPinned upstream references, using Kata Containers `main` commit `2ffd1538a296cff93a357bfba0dfca747480a1f8`:\n\n- runtime-rs standalone virtio-fs adds [`--sandbox none --seccomp none`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/crates/resource/src/share_fs/share_virtio_fs_standalone.rs#L82-L92) to the `virtiofsd` command line.\n- runtime-rs QEMU leaves rootless mode disabled by default: [`rootless = false`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in#L31-L34).\n- The QEMU runtime-rs config template generates an installed config that uses standalone virtio-fs and points runtime-rs at the host `virtiofsd` binary: [`shared_fs` and `virtio_fs_daemon`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in#L164-L171).\n- The runtime-rs Makefile resolves those placeholders to [`virtio-fs`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/Makefile#L496-L499) and [`$(LIBEXECDIR)/virtiofsd`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/Makefile#L184-L190).\n- runtime-rs selects the same standalone virtio-fs implementation whenever `shared_fs = \"virtio-fs\"`: [`ShareVirtioFsStandalone`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/crates/resource/src/share_fs/mod.rs#L158-L167).\n\n### Details\n\nThe guest kernel normally owns the virtio-fs client. A normal guest process will use filesystem syscalls, and the guest kernel will validate the paths, and only then does the kernel send FUSE messages to the host backend.\n\nAn attacker with root-equivalent access inside the guest can bypass that guest virtio-fs client. They can access the virtio-fs PCI device, mmap the virtio PCI BAR, recover guest physical addresses from `/proc/self/pagemap`, and build their own virtqueue from userspace. That queue can submit attacker-built FUSE messages directly to host `virtiofsd`.\n\nThe relevant primitive is `FUSE_SYMLINK`. An attacker can send a request whose body contains:\n\n```\nnew symlink name: /etc/cron.d/kata-go-escape-cron-\u003cpid\u003e\nsymlink target: /proc/\u003cpid\u003e/root/run/kata-containers/shared/sandboxes/\u003csid\u003e/ro/passthrough/\u003csid\u003e/rootfs/tmp/kata-go-escape-payload\n```\n\nThe new symlink name is an absolute host path. `virtiofsd` should reject that request or force it to resolve below the configured `--shared-dir`. In the tested runtime-rs path, host-root unsandboxed `virtiofsd` accepts the absolute name, creating a real host symlink under `/etc/cron.d`.\n\nThe attacker can make the symlink target resolve through `/proc/\u003cpid\u003e/root/...` for a live Kata runtime process whose mount namespace can see the guest-created payload. One matching runtime PID is enough.\n\nWhen the host cron reads `/etc/cron.d`, it follows the root-owned symlink, loads the guest-created crontab payload, and executes it as host root.\n\n### PoC\n\n```shell\nsudo timeout --foreground --kill-after=10s 600s ctr run --rm \\\n  --runtime /opt/kata/runtime-rs/bin/containerd-shim-kata-v2 \\\n  --runtime-config-path /opt/kata/share/defaults/kata-containers/runtime-rs/configuration-qemu-runtime-rs.toml \\\n  --privileged \\\n  --privileged-without-host-devices \\\n  docker.io/library/kata-go-escape:local \\\n  \"$run_id\"\n```\n\nThe container is privileged only to model the post-escape condition where the attacker already has guest-root capabilities. It is not the vulnerability by itself.\n\nInside the guest, the PoC:\n\n1. Writes a cron payload to guest `/tmp/kata-go-escape-payload`.\n2. Finds the virtio-fs PCI device in guest /sys.\n3. Takes over a virtio-fs queue from userspace.\n4. Sends `FUSE_INIT`.\n5. Discovers the current runtime-rs sandbox under `passthrough/`.\n6. Looks up `passthrough/\u003csid\u003e/rootfs/tmp/kata-go-escape-payload`.\n7. Sends raw `FUSE_SYMLINK` requests where the new symlink names are absolute host paths under `/etc/cron.d`.\n8. Keeps the guest alive while host cron scans.\n\nExample log lines:\n\n```\n[guest] virtio-fs PCI device: /sys/devices/pci0000:00/0000:00:05.0\n[res] sandbox_id=kata-go-escape-test-1778522686-1539\n[res] lookup_path_error=0 path=passthrough/kata-go-escape-test-1778522686-1539/rootfs/tmp/kata-go-escape-payload nodeid=21\n[spray] pid=1 err=-2 created_candidates=1\n```\n\n`err=-2` is expected for the symlink spray. `virtiofsd` can return `ENOENT` after the side effect because its follow-up lookup is still relative to the export root. The host symlink creation has already happened.\n\n### Impact\n\nThe PoC proves guest-root to host-root command execution.\n\nVerified host proof:\n\n```\n/run/kata-go-escape.proof\n\nuid=0(root) gid=0(root) groups=0(root)\nMon May 11 18:05:01 UTC 2026\n```\n\nThe proof file is written in host `/run` by host cron. It is not written by the guest process and not written by `virtiofsd`.\n\nAn attacker who reaches guest root can therefore cross the Kata isolation boundary and execute commands as host root on affected runtime-rs virtio-fs deployments.",
  "id": "GHSA-2gv2-cffp-j227",
  "modified": "2026-05-27T22:50:01Z",
  "published": "2026-05-27T22:50:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kata-containers/kata-containers"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kata-containers/kata-containers/releases/tag/3.31.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs"
}

MSRC_CVE-2026-47243

Vulnerability from csaf_microsoft - Published: 2026-08-09 01:02 - Updated: 2026-08-09 01:02

Summary

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-47243

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Under investigation 2 products

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—
Unresolved product id: 17084-2		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-47243.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs",
    "tracking": {
      "current_release_date": "2026-08-09T01:02:08.000Z",
      "generator": {
        "date": "2026-08-09T07:11:19.440Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-47243",
      "initial_release_date": "2026-08-09T01:02:08.000Z",
      "revision_history": [
        {
          "date": "2026-08-09T01:02:08.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "category": "product_name",
            "name": "azl3 kata-containers 0:3.19.1.kata3-7.azl3",
            "product": {
              "name": "azl3 kata-containers 0:3.19.1.kata3-7.azl3",
              "product_id": "1"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kata-containers-cc 0:3.15.0.aks0-16.azl3",
            "product": {
              "name": "azl3 kata-containers-cc 0:3.15.0.aks0-16.azl3",
              "product_id": "2"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kata-containers 0:3.19.1.kata3-7.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kata-containers-cc 0:3.15.0.aks0-16.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-47243",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "under_investigation": [
          "17084-1",
          "17084-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-47243.json"
        }
      ],
      "title": "Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-47243 (GCVE-0-2026-47243)

GHSA-2GV2-CFFP-J227

Summary

Affected configuration

Details

PoC

Impact

MSRC_CVE-2026-47243

Tags

Sightings

Nomenclature