CVE-2025-64324

Katalog CVE

CVSS 7.7 · High EPSS 0,22%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada kubevirt. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.

Rincian

Terbit di NVD

18 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh exploit · advisory vendor
• https://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764 patch
• https://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69 patch
• https://github.com/kubevirt/kubevirt/pull/15037 issue tracking