PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-28914] Big Bugs: Bitbucket Pipelines Kata Containers Build Container Escape

bugcrowd.com | vulnerability | CVE-2020-28914 | #container-security | #container-escape | #cve-2020-28914 | #kata-containers | #bitbucket-pipelines | #ci-cd-security | #atlassian
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Kata Containers flaw (CVE-2020-28914) let processes in the Kata VM write to read-only volume mounts, so a malicious build job could overwrite host files as root via Bitbucket Pipelines.
CVE
CVE-2020-28914
Published
Collected

Related coverage

High · vulnerability · bugcrowd.com
What we know about Copy Fail (CVE-2026-31431)
Copy Fail (CVE-2026-31431) is a Linux kernel LPE zero-day since 2017: an algif_aead logic flaw grants root and container escape; a public 732-byte exploit was found by AI in an hour.
vulnerability · hackerone.com
Severe Confluence Vulnerability is an Active Threat (CVE-2022-26134)
An unauthenticated RCE zero-day in Atlassian Confluence (CVE-2022-26134) was exploited in the wild before disclosure, with attack IPs surging past 800 within days. Patching should be immediate.
vulnerability · hackerone.com
HackerOne and JIRA integration update: more improvements, fewer clicks
HackerOne's JIRA integration gets three updates: the connector is now live on the Atlassian Marketplace, JIRA issues can be created in one click from a report, and two-way syncing is customizable per workflow.
vulnerability · aikido.dev
A Guide to Container Privilege Escalation Vulnerabilities
Container isolation breaks down when attackers escalate privileges, turning a low-privileged foothold into full host compromise. The guide covers CVE-2019-5736, CVE-2024-21626, and prevention.
Critical · vulnerability · github.com
gVisor Sandbox Escape PoC: Host Root RCE via directfs openHandle Type Confusion
Demonstrates a complete, verified sandbox escape against gVisor container runtimes by chaining file system descriptor race conditions with host udev device probing to break container isolation completely.
vulnerability · idnsec.com
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Write-up of CVE-2025-39964, an AF_ALG race condition in the Linux kernel enabling an out-of-bounds scatterlist write. The exploit overwrites core_pattern for root and a Docker container escape.
Back