REDHAT-BUG-2493378: Medium severity Kubevirt migration proxy (pkg/virt-handler/migration-proxy/migration-proxy.go) vulnerability
A flaw was found in KubeVirt's migration proxy (pkg/virt-handler/migration-proxy/migration-proxy.go). When spec.configuration.migrations.disableTLS is set to true on the KubeVirt CR, serverTLSConfig is nilled and createTcpListener falls through to a plain net.Listen("tcp", ...) with no authentication. The listener binds unconditionally on 0.0.0.0/:: via GetIPZeroAddress() (pkg/util/net/ip/ip.go). The accept handler (handleConnection) performs no peer-IP check, no auth token validation, and immediately starts io.Copy into the target UNIX socket. The first proxied socket is virtqemud-sock, configured with authunixrw=none. Any pod on the cluster network can connect and speak libvirt RPC against another tenant's VM.
The migrations.network NAD configuration only changes the advertised migrationIpAddress (pkg/virt-handler/migration.go), not the listener bind, so the port remains reachable on the pod network even with a dedicated migration network. The API godoc (staging/src/kubevirt.io/api/core/v1/types.go) describes disableTLS as removing "the additional layer of live migration encryption" without disclosing the authentication removal. disableTLS is cluster-admin-only on the KubeVirt CR and is not available in the MigrationPolicy spec.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not set spec.configuration.migrations.disableTLS=true on the KubeVirt CR; when disableTLS is true it nils serverTLSConfig and createTcpListener uses plain net.Listen(...) with no authentication.
KubeVirt spec.configuration.migrations.disableTLS = false - Configuration
Ensure the proxied virtqemud-sock is not configured with auth_unix_rw=none; configure Unix-RPC socket authentication so libvirt RPC cannot be issued cross-tenant without auth.
KubeVirt migration proxy (pkg/virt-handler/migration-proxy/migration-proxy.go) virtqemud-sock auth_unix_rw = enabled (not 'none') - Compensating control
Restrict network access to the migration proxy listener so only pods/nodes on the dedicated migration network can reach it (the listener binds unconditionally on 0.0.0.0/:: and the migrations.network NAD only changes advertised migrationIpAddress, not the bind).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2493378?
The severity of REDHAT-BUG-2493378 is classified as medium, rated at 4.
What software is affected by REDHAT-BUG-2493378?
The vulnerability affects the KubeVirt migration proxy found in pkg/virt-handler/migration-proxy/migration-proxy.go.
How does REDHAT-BUG-2493378 affect security?
The flaw allows for a lack of authentication when TLS is disabled, potentially exposing communication to unauthorized access.
How can I mitigate the risk associated with REDHAT-BUG-2493378?
To mitigate this risk, ensure that spec.configuration.migrations.disableTLS is set to false in the KubeVirt CR to maintain TLS authentication.
What is the main issue identified in REDHAT-BUG-2493378?
The main issue is that when TLS is disabled, the migration proxy falls back to an unsecured TCP listener without proper authentication.