CVE-2019-10147 describes a critical vulnerability in rkt container runtime versions up to 1.30.0, specifically impacting Red Hat rkt. This flaw allows processes executed via rkt enter to bypass cgroup isolation, potentially enabling compromised containers to access host resources. With a CVSS score of 7.7 (HIGH), the vulnerability has a local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, allowing for potential root access to the host. While no public exploit code or Metasploit modules are available, the vulnerability has garnered community discussion and media coverage, indicating awareness, though it is not listed on CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.30.0CPE matchmatch criteria | cpe:2.3:a:redhat:rkt:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.