CVE-2024-1725: Kubevirt-csi: persistentvolume allows access to hcp's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Other sources
A security issue has been discovered in the HCP OpenShift Virtualization provider that allows unauthorized users to gain access to HCP worker node root volumes.
The attack vector is a component called kubevirt-csi, which provides the ability for an HCO OCP-Virt guest cluster to be configured in a way that lets the guest cluster use the same underlying storage as the infrastructure cluster the VMs are running in. Through the use of kubevirt-csi and a well crafted PV within the HCP OCP-Virt guest cluster, a user who has the ability to create PVs can gain access to any node's root volume by crafting a PV volumeHandle that matches the name of a worker node VM's root volume PVC. That name is trivial to predict because it is the node's name followed by "-rhcos".
The result is the user can then get kubevirt-csi to attach any node's root volume to a pod workload within the guest cluster as a PVC.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1725?
CVE-2024-1725 has been classified as a critical severity vulnerability.
How do I fix CVE-2024-1725?
To fix CVE-2024-1725, update the kubevirt-csi component of Red Hat OpenShift Virtualization to a version that includes the security patch.
What is the impact of CVE-2024-1725 on OpenShift Virtualization?
CVE-2024-1725 can potentially allow authenticated attackers to access the root HCP worker node's volume.
Who is affected by CVE-2024-1725?
CVE-2024-1725 affects users of Red Hat OpenShift Virtualization utilizing the kubevirt-csi component.
Is CVE-2024-1725 exploitable remotely?
CVE-2024-1725 is not a remote attack vulnerability, as it requires authenticated access to exploit.