VULNERABILITY INTELLIGENCE

CVE-2019-10144

CVSS score7.7 HIGH

EPSS probability0.47%

CISA KEVNot currently listed

Published2019-06-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Description

rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.

Weakness classification

CWE-250: Execution with Unnecessary Privileges
CWE-269: Improper Privilege Management

Primary references

secalert@redhat.com — Issue Tracking, Third Party Advisory
secalert@redhat.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory