visor/website/_data/cve-track-record.yml at master

mirror of https://github.com/hanzoai/visor.git synced 2026-09-24 17:04:14 +00:00

Files

T

Nayana BidariandgVisor bot 1d8cfce53f Update gvisor security track record.

Update gVisor security track record that it is not affected by CVE-2026-43500
vulnerability related to RxRPC protocol.

PiperOrigin-RevId: 964360221

2026-08-13 16:37:11 -07:00

784 lines

28 KiB

YAML

Raw Permalink Blame History

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

 cves:
   - date: "2016-01"
     description: "A race condition in `mm/gup.c` allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2016-5195"
     cvss: 7.2
     exploitable_under_gvisor: false
   - date: "2017-01"
     description: "Insufficient data validation in `waitid` allowed an user to escape sandboxes on Linux."
     risk: "Pod-to-guest escalation"
     scope: "All Linux containers"
     cve: "CVE-2017-5123"
     cvss: null
     exploitable_under_gvisor: false
   - date: "2020-09"
     description: "Memory corruption in the Linux kernel packet socket (`AF_PACKET`) allows unprivileged processes to gain root privileges."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2020-14386"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2021-05"
     description: "A symlink-exchange race condition in `runc` allows container filesystem breakout via directory traversal."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2021-30465"
     cvss: 8.5
     exploitable_under_gvisor: true
     patched: "PATCHED"
     mitigation_gap: "`runsc` (gVisor) also handles mount paths similar to `runc` to prepare the container's rootfs"
     vm_prevented: false
   - date: "2021-07"
     description: "An integer overflow in `fs/seq_file.c` buffer allocations leads to an out-of-bounds write and root privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2021-33909"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2021-12"
     description: "A use-after-free flaw in the Linux kernel `cgroup` v1 parser allows local privilege escalation and container breakout."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2021-4154"
     cvss: 8.8
     exploitable_under_gvisor: false
   - date: "2022-01"
     description: "A double free bug in `packet_set_ring()` in `net/packet/af_packet.c` can be exploited by a local user through crafted syscalls to escalate privileges or deny service."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2021-22600"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-01"
     description: "A heap-based buffer overflow flaw was found in the way the `legacy_parse_param` function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-0185"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-02"
     description: "A vulnerability was found in the Linux kernel’s `cgroup_release_agent_write` in the `kernel/cgroup/cgroup-v1.c` function."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-0492"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-04"
     description: "A flaw was found in the way the 'flags' member of the new pipe buffer structure was lacking proper initialization in `copy_page_to_iter_pipe` and `push_pipe` functions in the Linux kernel and could thus contain stale values."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-0847"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-04"
     description: "A use-after-free exists in the Linux Kernel in `tc_new_tfilter` that could allow a local attacker to gain privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-1055"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-04"
     description: "A heap buffer overflow flaw was found in IPsec ESP transformation code in `net/ipv4/esp4.c` and `net/ipv6/esp6.c`."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-27666"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-06"
     description: "Integer Overflow or Wraparound vulnerability in `io_uring` of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-1116"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-06"
     description: "A use-after-free flaw was found in the Linux kernel’s `io_uring` subsystem in the way a user sets up a ring with `IORING_SETUP_IOPOLL` with more than one task completing submissions on this ring."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-1786"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-06"
     description: "Improper Update of Reference Count vulnerability in `net/sched` of Linux Kernel allows local attacker to cause privilege escalation to root."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-29581"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-06"
     description: "In the Linux kernel, `fs/io_uring.c` has a use-after-free due to a race condition in `io_uring` timeouts."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-29582"
     cvss: 7.0
     exploitable_under_gvisor: false
   - date: "2022-06"
     description: "A speculative execution vulnerability (Retbleed) in modern microprocessors allows unprivileged attackers to leak kernel memory."
     risk: "Cross-customer data leak"
     scope: "AMD + Intel machines"
     cve: "CVE-2022-29900"
     cvss: 6.5
     exploitable_under_gvisor: true
     patched: "EXTERNAL_MITIGATION_REQUIRED"
     mitigation_gap: "Hardware CPU vulnerability requiring microcode mitigation."
     vm_prevented: false
   - date: "2022-07"
     description: "`Io_uring` use `work_flags` to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing `IORING_OP`."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-2327"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-09"
     description: "In `io_identity_cow` of `io_uring.c`, there is a possible way to corrupt memory due to a use after free."
     risk: "Pod-to-guest escalation with root privs"
     scope: "All Linux VMs"
     cve: "CVE-2022-20409"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-09"
     description: "There exists a use-after-free in `io_uring` in the Linux kernel."
     risk: "Pod-to-guest escalation with root privs"
     scope: "All Linux VMs"
     cve: "CVE-2022-3176"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-10"
     description: "It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free."
     risk: "Pod-to-guest escalation with root privs"
     scope: "All Linux VMs"
     cve: "CVE-2022-2585"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2022-10"
     description: "`Io_uring` UAF, Unix SCM garbage collection."
     risk: "Pod-to-guest escalation with root privs"
     scope: "All Linux VMs"
     cve: "CVE-2022-2602"
     cvss: 6.5
     exploitable_under_gvisor: false
   - date: "2022-12"
     description: "Moby is an open-source project created by Docker to enable and accelerate software containerization."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-24769"
     cvss: 6.5
     exploitable_under_gvisor: false
   - date: "2023-02"
     description: "Privilege escalation in `io_uring`"
     risk: "Pod-to-guest escalation with root privs"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-03"
     description: "Use After Free vulnerability in Linux kernel traffic control index filter (`tcindex`) allows Privilege Escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-1281"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "This flaw makes `curl` overflow a heap based buffer in the SOCKS5 proxy handshake."
     risk: "Pod-to-guest escalation"
     scope: "Container images using `libcurl`"
     cve: "CVE-2023-38545"
     cvss: 8.1
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `netfilter`: `nf_tables` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4015"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free flaw was found in the Linux kernel’s `Netfilter` functionality when adding a rule with `NFTA_RULE_CHAIN_ID`."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4147"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `net/sched`: `cls_route` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4206"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `net/sched`: `cls_fw` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4207"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `net/sched`: `cls_u32` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4208"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `af_unix` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4622"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `net/sched`: `sch_hfsc` (HFSC `qdisc` traffic control) component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4623"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-10"
     description: "A use-after-free vulnerability in the Linux kernel's `net/sched`: `sch_qfq` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-4921"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-12"
     description: "A use-after-free vulnerability in the Linux kernel's `netfilter`: `nf_tables` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-6111"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2023-12"
     description: "A use-after-free vulnerability in the Linux kernel's `netfilter`: `nf_tables` component can be exploited to achieve local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-6817"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-01"
     description: "`Runc` is a CLI tool for spawning and running containers on Linux according to the OCI specification."
     risk: "Pod-to-guest escalation"
     scope: "All Linux containers"
     cve: "CVE-2024-21626"
     cvss: 8.2
     exploitable_under_gvisor: false
   - date: "2024-02"
     description: "Privilege escalation due to use-after-free in kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-52447"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-02"
     description: "A use-after-free flaw was found in the `netfilter` subsystem of the Linux kernel."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-0193"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-02"
     description: "Privilege escalation due to use-after-free in `nf_tables`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-26581"
     cvss: 7.0
     exploitable_under_gvisor: false
   - date: "2024-02"
     description: "Privilege escalation due to use-after-free in kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-26583"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-02"
     description: "Privilege escalation due to use-after-free in kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-26584"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-02"
     description: "Privilege escalation due to use-after-free in kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-26585"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-03"
     description: "Privilege escalation due to anonymous set in `nf_tables`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-03"
     description: "Privilege escalation due to race condition in `nf_tables`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-03"
     description: "Privilege escalation due to use-after-free in `nf_tables`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-03"
     description: "Privilege escalation in `nft_verdict_init`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-04"
     description: "Unsafe Python Pickle deserialization of ML models"
     risk: "Pod-to-guest escalation"
     scope: "ML API endpoints"
     cve: ""
     cvss: 8.8
     exploitable_under_gvisor: false
   - date: "2024-04"
     description: "Privilege escalations due to use-after-free in packet processing"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-05"
     description: "Vulnerability in `io_uring` and `SCM_RIGHTS`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-05"
     description: "Out-of-bounds access in eBPF verifier"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2022-23222"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-05"
     description: "Privilege escalation due to use-after-free in kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-26800"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-05"
     description: "Privilege escalation in `net/packet` / `nf_tables`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-26925"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-06"
     description: "Capabilities inheritance flaw in `containerd` 1.4"
     risk: "Pod-to-guest escalation"
     scope: "Containerd 1.4"
     cve: "GHSA-c9cp-9c75-9v8c"
     cvss: 7.5
     exploitable_under_gvisor: false
   - date: "2024-10"
     description: "Use-after-free flaw in `Qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-46800"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2024-11"
     description: "Bad handling of symlinks in malicious user-supplied image"
     risk: "Arbitrary host file read"
     scope: "OSS containers with GPU"
     cve: "CVE-2024-0132"
     cvss: 8.7
     exploitable_under_gvisor: true
     patched: "PATCHED"
     mitigation_gap: "The flaw occurs outside of the container sandbox."
     vm_prevented: true
   - date: "2025-02"
     description: "Privilege escalation in `netfilters`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-53141"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-03"
     description: "Privilege escalation in `netfilter`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-52927"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-03"
     description: "Linux `qdisc` implementation flaw"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2024-53164"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-03"
     description: "`Vsock` privilege escalation"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-21756"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-04"
     description: "Local privilege escalation in `qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-21700"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-04"
     description: "Local privilege escalation in `qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-21703"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-05"
     description: "`ctstate` `RELATED` `iptables` rule flaw"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2023-52927"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-05"
     description: "Operations on net devices during unregister"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-21701"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-05"
     description: "Local privilege escalation in `qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-37752"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-05"
     description: "Local privilege escalation in `qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-37797"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-05"
     description: "Local privilege escalation in `qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-37798"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-05"
     description: "`io_uring` ring mapped supplied buffers vulnerability"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-40364"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-06"
     description: "Use-after-free in HFSC packet scheduling"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38000"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-06"
     description: "Use-after-free in HFSC packet scheduling"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38001"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-06"
     description: "Race in PRIO `qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38083"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-07"
     description: "Use-after-free in `Qdisc`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38350"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-07"
     description: "Use-after-free in QFQ scheduling"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38477"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-08"
     description: "Use-after-free in `xfrm` interface"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38500"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-08"
     description: "Data corruption in Kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38616"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-08"
     description: "Use-after-free in `net/packet`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38617"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-08"
     description: "Use-after-free in `vsock`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-38618"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-10"
     description: "Buffer overflow in Kernel TLS"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-39946"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-10"
     description: "Data race in `AF_ALG` socket"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-39964"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-10"
     description: "Data corruption in IPSec"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-39965"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-10"
     description: "Use-after-free in IP Virtual Server"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-40018"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-10"
     description: "Integer underflow in crypto"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-40019"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-12"
     description: "Data race in GC alive socket receiver queue"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-40214"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2025-12"
     description: "Data race deleting tunnel"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2025-40215"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-02"
     description: "NULL pointer dereference in `authencesn`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23060"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-02"
     description: "Use-after-free in `teql`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23074"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-02"
     description: "Use-after-free in `nftables` map"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23111"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-02"
     description: "Use-after-free in `macvlan`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23209"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-03"
     description: "Local privilege escalation in AppArmor"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-03"
     description: "Read/write tenant data in shared GPU environments"
     risk: "Local privilege escalation"
     scope: "NVIDIA GPUs"
     cve: ""
     cvss: 8.2
     exploitable_under_gvisor: true
     patched: "PATCHED"
     mitigation_gap: ""
     vm_prevented: true
   - date: "2026-03"
     description: "Use-after-free in `nf_tables`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23231"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-03"
     description: "Denial of Service due to cleanup failure in `nf_tables`"
     risk: "Denial of Service"
     scope: "All Linux VMs"
     cve: "CVE-2026-23278"
     cvss: 7.5
     exploitable_under_gvisor: false
   - date: "2026-03"
     description: "Local Denial of Service in `netfilter`"
     risk: "Denial of Service"
     scope: "All Linux VMs"
     cve: "CVE-2026-23351"
     cvss: 7.5
     exploitable_under_gvisor: false
   - date: "2026-03"
     description: "Use-after-free in `af_unix` GC"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23394"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-03"
     description: "Local privilege escalation in `snap-confine` and `systemd-tmpfiles`"
     risk: "Pod-to-guest escalation"
     scope: "Ubuntu VMs"
     cve: "CVE-2026-3888"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Use-after-free via race condition"
     risk: "Denial of Service"
     scope: "All Linux VMs"
     cve: "CVE-2026-23240"
     cvss: 9.8
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Use-after-free in `netfilter`"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-23392"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Data structure mishandling in `ipset`"
     risk: "Network policy bypass"
     scope: "All Linux VMs"
     cve: "CVE-2026-31418"
     cvss: 7.5
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Use-after-free in IPv6 stack"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-31419"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Chained attack in `AF_ALG` + `splice` syscall"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-31431"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Use-after-free in `packet_release` via `NETDEV_UP` race"
     risk: "Denial of Service"
     scope: "All Linux VMs"
     cve: "CVE-2026-31504"
     cvss: 7.5
     exploitable_under_gvisor: false
   - date: "2026-04"
     description: "Use-after-free in `tls_do_encryption`"
     risk: "Denial of Service"
     scope: "All Linux VMs"
     cve: "CVE-2026-31533"
     cvss: 7.5
     exploitable_under_gvisor: false
   - date: "2026-05"
     description: "Linux bonding device vulnerability leading to container escape"
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: ""
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-05"
     description: "Improper handling of shared socket buffer (skb) fragments during Encapsulating Security Payload (ESP) decryption in the xfrm subsystem in the Linux kernel allows a local user to write to read-only page-cache pages, potentially leading to local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-43284"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-05"
     description: "A type confusion vulnerability in the Linux kernel network bonding driver ('bond_setup_by_slave') allows memory corruption and local privilege escalation when enslaving non-Ethernet devices."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-43456"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-05"
     description: "GhostLock: A use-after-free vulnerability in the Linux kernel rtmutex implementation during futex_requeue operations allows local privilege escalation and container escapes."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-43499"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-05"
     description: "An out-of-bounds write and use-after-free vulnerability in the Linux kernel's RxRPC networking subsystem, known as 'Dirty Frag'. It allows for local privilege escalation due to mishandling of paged fragments."
     risk: "Local privilege escalation"
     scope: "All Linux containers"
     cve: "CVE-2026-43500"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-06"
     description: "DirtyClone: Failure to properly propagate the SKBFL_SHARED_FRAG flag when cloning network packets in the Linux kernel allows local privilege escalation."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-43503"
     cvss: 8.8
     exploitable_under_gvisor: false
   - date: "2026-05"
     description: "A logic vulnerability in the Linux kernel XFRM ESP-in-TCP subsystem ('Fragnesia') allows an unprivileged local user to overwrite kernel page cache and escalate privileges to root or break out of containers."
     risk: "Pod-to-guest escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-46300"
     cvss: 7.8
     exploitable_under_gvisor: false
   - date: "2026-07"
     description: "Januscape: A use-after-free vulnerability in the KVM shadow MMU code in the Linux kernel allows guest-to-host escape and privilege escalation to root."
     risk: "Guest-to-host escalation"
     scope: "All Linux VMs"
     cve: "CVE-2026-53359"
     cvss: 7.1
     exploitable_under_gvisor: false

784 lines 28 KiB YAML Raw Permalink Blame History Unescape Escape

784 lines

28 KiB

YAML

Raw Permalink Blame History