Background

I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.

To mitigate this threat, people came up with certificate authorities that essentially "vouches" for the trust of 3rd parties by supplying you their respective public keys signed with the CA's own private keys.

Question

Here is where I am getting confused.

Can't we just use the same logic to intercept and compromise the transfer of information between the user and the CA (certificate authority)?

If the Certificate authority vouches for the Generic Website to ensure trust and safety, who vouches for the Certificate authority?

Maarten Bodewes answer is correct but I think the heart of your question is a major hurdle people face in understanding certificates and CAs.  I think it's worth elaborating on the part of how this works that I think you are missing.

As stated in Maarten's answer, your computer/browser has been preconfigured with a set of trusted CAs.  If you are running Windows you can see what these are by running certmgr.msc (you must type the entire name in search).  In that application, you will see a number of folders.  One of these is named "Trusted Root Certification Authorities".  If you expand "Certificates" under that folder, you will see a long list of certificates for various CAs.

When you go to a website and you get a 'trusted' lock icon, that means that the certificate they are presenting has a parentage that includes a certificate in this store.  I'm oversimplifying slightly here but this is the core idea.  For example, if I look at the certificates at google.com, the grandparent certificate has the friendly name of "Google Trust Services - GlobalSign Root CA-R2".  I look at my store and I see that exact certificate which I can verify by looking at the 'thumbprint'.

So the reason that no one can MiTM the root certificates is that you are not going out to the CA to get your trusted CAs, you already have them on your machine.  If you browse a website with a CA cert that don't have in your trusted CA store, your browser should throw a lot of warnings at you that the site is not trusted.

I hope this helps.  A side note is that this should also help you to understand how much risk there is in importing a new trusted root certificate.  For example, let's say you are doing some experimentation and generate your own 'CA' certificate.  You import this as a trusted CA and voilà! You now can sign certificates that your browser trusts.  But consider what could then happen if someone else gets access to the private key you generated for that root CA.  They now can create a certificate for any  website and unless you check the cert chain on each site you go to, you could become subject to a MiTM attack.
