CVE-2025-64437mediumCWE-59

CVE-2025-64437: fallo de gravedad media en kubevirt

KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear kubevirt+ Monitorear kubevirt.io/kubevirt

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5epss 0.2%
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Productos afectados
kubevirt · kubevirt
CVEs relacionadas — kubevirt

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-26484HIGHOn a compromised KubeVirt node, the virt-handler service account can be used to modify all node specsEPSS 0.6%CVE-2025-64433MEDIUMKubeVirt Arbitrary Container File ReadEPSS 0.5%CVE-2025-64435MEDIUMKubeVirt VMI Denial-of-Service (DoS) Using Pod ImpersonationEPSS 0.4%CVE-2025-64436MEDIUMKubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between NodesEPSS 0.3%CVE-2025-64324HIGHKubeVirt Vulnerable to Arbitrary Host File Read and WriteEPSS 0.2%CVE-2025-64434MEDIUMKubeVirt Improper TLS Certificate Management Handling Allows API Identity SpoofingEPSS 0.2%