rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rkt | Redhat | * | 1.30.0 (including) |
| Rkt | Ubuntu | bionic | * |
| Rkt | Ubuntu | cosmic | * |
| Rkt | Ubuntu | disco | * |
| Rkt | Ubuntu | eoan | * |
| Rkt | Ubuntu | groovy | * |
| Rkt | Ubuntu | trusty | * |