REDHAT-BUG-2493576: Input Validation
A flaw was found in KubeVirt's network annotation generator. The tenant-supplied multus.networkName in a VMI spec is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without input validation. When the ExternalNetResourceInjection Beta feature gate is enabled (off by default), no NAD lookup is performed to catch malformed values, and a tenant can inject a JSON-formatted NetworkSelectionElement array to attach the pod to arbitrary network attachments in any namespace with attacker-controlled IP and MAC addresses. This enables cross-namespace network access and service impersonation. The vulnerable code path was introduced with the ExternalNetResourceInjection feature gate in KubeVirt v1.8.0, first shipped in OpenShift Virtualization 4.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubeVirtto a version that resolves this vulnerability.Fixed in 1.8.0 - Configuration
Ensure the ExternalNetResourceInjection Beta feature gate remains disabled to prevent tenant-supplied multus.networkName from being written verbatim into the launcher pod annotation without input validation.
KubeVirt feature gate ExternalNetResourceInjection = disabled (off by default) - Compensating control
If the ExternalNetResourceInjection Beta feature gate must be enabled, restrict tenant ability to set multus.networkName in VMI specs (e.g., via admission controls/policy) to mitigate cross-namespace network access and service impersonation risks from attacker-controlled IP/MAC injection.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2493576?
The severity of REDHAT-BUG-2493576 is medium with a risk rating of 4.
What does REDHAT-BUG-2493576 entail?
REDHAT-BUG-2493576 describes a flaw in KubeVirt's network annotation generator that lacks input validation for tenant-supplied multus.networkName.
How do I fix REDHAT-BUG-2493576?
To fix REDHAT-BUG-2493576, ensure proper input validation is implemented for multus.networkName in the VMI spec.
Which software is affected by REDHAT-BUG-2493576?
The affected software in REDHAT-BUG-2493576 is KubeVirt's network annotation generator.
What is the impact of REDHAT-BUG-2493576?
The impact of REDHAT-BUG-2493576 is that it could allow improper network configuration due to lack of input validation.