REDHAT-BUG-2492681: Low severity KubeVirt vulnerability
A flaw was found in KubeVirt's downward metrics virtio-serial server in virt-handler. The server reads guest requests using textproto.Reader.ReadLine() in pkg/downwardmetrics/virtio-serial/server.go, which buffers input indefinitely until a newline character is received, with no length limit or read deadline. The server is started from dmetrics-manager.go and wired into the virt-handler process at cmd/virt-handler/virt-handler.go — it runs inside virt-handler's address space, not in the per-VM virt-launcher pod. A VM guest writing a continuous byte stream without newlines to the downward-metrics virtio-serial channel causes unbounded heap allocation in virt-handler until it is OOM-killed. Affected image: virt-handler-rhel9. Upstream fix should wrap the reader in io.LimitedReader with a small cap and add a per-read deadline.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the upstream code fix to virt-handler downward-metrics virtio-serial server (pkg/downwardmetrics/virtio-serial/server.go) by wrapping the textproto.Reader input with an io.LimitedReader (small cap) and adding a per-read deadline, to prevent unbounded heap allocation when the guest writes a continuous byte stream without newlines.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2492681?
The severity of REDHAT-BUG-2492681 is classified as low.
What flaw is identified in REDHAT-BUG-2492681?
REDHAT-BUG-2492681 identifies a flaw in KubeVirt's virtio-serial server where it reads guest requests indefinitely until a newline character is received.
What software is affected by REDHAT-BUG-2492681?
KubeVirt is the software affected by REDHAT-BUG-2492681.
How can I mitigate the issue described in REDHAT-BUG-2492681?
Mitigation for REDHAT-BUG-2492681 can include applying updates as they become available, and reviewing the configuration of KubeVirt's virtio-serial server.
What should I do if I suspect exploitation of REDHAT-BUG-2492681?
If you suspect exploitation of REDHAT-BUG-2492681, it is important to monitor system logs and isolate affected environments while addressing the vulnerability.