Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kata-containers/kata-containers
main @ 392b802
142
Fixes
1
CVEs
HIGH
Peak severity
28.6%
Coverage
Highlights
Denial of Service: 37 prior fixes. Scrutinize any change in this area.
genpolicy: most-fixed (10 issues). Treat as high-risk during review.
53 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Workloads could bypass container limits if cgroup configurations are not strictly isolated, requiring the explicit use of isolated cgroup namespaces and narrow parent device rules.
Auth Bypass: Misconfigured or imprecise OPA/Rego policies in genpolicy rules (such as validating exec command arrays as joined strings or matching sandboxes insecurely) allowed policy bypasses.
Path Traversal: Unsanitized copying of host-to-guest shared directories allowed directory traversal, mitigated by restricting operations to safe, canonicalized volume directories.