Kata Containers Kata Containers

Kata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Container to Guest micro VM privilege escalation

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on the worker nodes.

Kata Containers: CopyFile Policy Subversion via Symlinks