CVE-2025-58354

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-58354
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58354.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58354
Aliases
  • GHSA-989w-4xr2-ww9m
Published
2025-09-23T21:08:47.147Z
Modified
2026-07-15T01:49:17.417093598Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kata Containers coco-tdx malicious host can circumvent initdata verification
Details

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-754"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58354.json"
}
References

Affected packages

Git / github.com/kata-containers/kata-containers

Affected ranges

Type
GIT
Repo
https://github.com/kata-containers/kata-containers
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e67f92e34be974e792c153add76e4e4baac9de0
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.21.0"
        }
    ]
}

Affected versions

1.*
1.10.0-rc0
1.11.0-alpha0
1.11.0-alpha1
1.9.3
2.*
2.0.0-alpha1
2.0.0-alpha2
2.0.0-alpha3
2.0.0-rc0
2.1-alpha0
2.1-alpha1
2.1.0-alpha0
2.1.0-alpha1
2.1.0-alpha2
2.1.0-rc0
2.2.0-alpha0
2.2.0-alpha1
2.2.0-rc0
2.3.0-alpha0
2.3.0-alpha1
2.3.0-alpha2
2.3.0-rc0
2.4.0-alpha0
2.4.0-alpha1
2.4.0-alpha2
2.4.0-rc0
2.5.0-alpha0
2.5.0-alpha1
2.5.0-alpha2
2.5.0-rc0
3.*
3.0.0-alpha0
3.0.0-alpha1
3.0.0-rc0
3.1.0-alpha0
3.1.0-alpha1
3.1.0-rc0
3.10.0
3.10.1
3.11.0
3.12.0
3.13.0
3.14.0
3.15.0
3.16.0
3.17.0
3.18.0
3.19.0
3.19.1
3.2.0-alpha0
3.2.0-alpha1
3.2.0-alpha2
3.2.0-alpha3
3.2.0-alpha4
3.2.0-rc0
3.20.0
3.3.0
3.3.0-alpha0
3.3.0-test
3.4.0
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
Other
untagged-b5b6198308b02e3a2666
untagged-c2a61792b39392572d0f

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58354.json"