Log in Start free

Vulnerability · Published Mar 7, 2024 · Assigned by redhat

CVE-2024-1725Kubevirt-csi: persistentvolume allows access to hcp's root node

Medium 6.5

In plain English

A medium-severity security flaw in kubevirt-csi-driver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 49.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kubevirt/csi-driver0.0.0-202403081943-cc28dcbb0afc14GHSA-fg9q-5cw2-p6r9
Gogithub.com/kubevirt/csi-driverno fix listedGO-2025-3512

Affected products (as reported)

VendorProductVersions
kubevirt-csi-driver see references
Red Hat Red Hat OpenShift Container Platform 4.13 see references
Red Hat Red Hat OpenShift Container Platform 4.14 see references
Red Hat Red Hat OpenShift Container Platform 4.15 see references

Weakness: CWE-501 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References