CVE-2024-1725: Kubevirt-csi: persistentvolume allows access to hcp's root node
First published: Wed Feb 21 2024(Updated: )
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Virtualization | ||
| Red Hat OpenShift Container Platform | =4.13 | |
| Red Hat OpenShift Container Platform | =4.14 | |
| Red Hat OpenShift Container Platform | =4.15 | |
| Red Hat OpenShift Container Platform | =4.13 | |
| Red Hat OpenShift Container Platform | =4.14 | |
| Red Hat OpenShift Container Platform | =4.15 | |
| Red Hat OpenShift Container Platform | =4.13 | |
| Red Hat OpenShift Container Platform | =4.14 | |
| Red Hat OpenShift Container Platform | =4.15 | |
| Red Hat OpenShift Container Platform | =4.13 | |
| Red Hat OpenShift Container Platform | =4.14 | |
| Red Hat OpenShift Container Platform | =4.15 | |
| Red Hat OpenShift Container Platform for Power | =4.13 | |
| Red Hat OpenShift Container Platform for Power | =4.14 | |
| Red Hat OpenShift Container Platform for Power | =4.15 | |
| go/github.com/kubevirt/csi-driver | <0.0.0-202403081943-cc28dcbb0afc14 | 0.0.0-202403081943-cc28dcbb0afc14 |
| =4.13 | ||
| =4.14 | ||
| =4.15 | ||
| =4.13 | ||
| =4.14 | ||
| =4.15 | ||
| =4.13 | ||
| =4.14 | ||
| =4.15 | ||
| =4.13 | ||
| =4.14 | ||
| =4.15 | ||
| =4.13 | ||
| =4.14 | ||
| =4.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:1559
- https://access.redhat.com/errata/RHSA-2024:1891
- https://access.redhat.com/errata/RHSA-2024:2047
- https://github.com/kubevirt/csi-driver/pull/103/commits/a61f36c42700f54352919318ed806d1ae2d716f4
- https://bugzilla.redhat.com/show_bug.cgi?id=2265398
- https://access.redhat.com/security/cve/CVE-2024-1725
- https://nvd.nist.gov/vuln/detail/CVE-2024-1725
- https://github.com/kubevirt/csi-driver/commit/cc28dcbb0afca0a7cb8a73bc998ab49f864ed560
- https://pkg.go.dev/vuln/GO-2025-3512
- https://github.com/advisories/GHSA-fg9q-5cw2-p6r9 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-1725?
CVE-2024-1725 has been classified as a critical severity vulnerability.
How do I fix CVE-2024-1725?
To fix CVE-2024-1725, update the kubevirt-csi component of Red Hat OpenShift Virtualization to a version that includes the security patch.
What is the impact of CVE-2024-1725 on OpenShift Virtualization?
CVE-2024-1725 can potentially allow authenticated attackers to access the root HCP worker node's volume.
Who is affected by CVE-2024-1725?
CVE-2024-1725 affects users of Red Hat OpenShift Virtualization utilizing the kubevirt-csi component.
Is CVE-2024-1725 exploitable remotely?
CVE-2024-1725 is not a remote attack vulnerability, as it requires authenticated access to exploit.
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/title
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-1725
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-fg9q-5cw2-p6r9
- agent/last-modified-date
- agent/references
- agent/tags
- collector/github-advisory
- vendor/red hat
- canonical/red hat openshift virtualization
- vendor/redhat
- canonical/red hat openshift container platform
- version/red hat openshift container platform/4.13
- version/red hat openshift container platform/4.14
- version/red hat openshift container platform/4.15
- canonical/red hat openshift container platform for power
- version/red hat openshift container platform for power/4.13
- version/red hat openshift container platform for power/4.14
- version/red hat openshift container platform for power/4.15
- package-manager/go