CVE-2025-64324
Description
A flaw was found in KubeVirt's hostDisk feature. A logic bug in the DiskOrCreate option, which creates a file if it doesn't exist when mounting host files or directories into a VM, allows an attacker with VM creation privileges to read and write arbitrary files owned by more privileged users on the host system beyond the intended UID 107 restriction.
Statement
This vulnerability is MODERATE because successful exploitation would require authenticated cluster access with specific RBAC permissions to create VMs using the hostDisk feature -capabilities that are restricted to trusted users in properly configured environments and not available to standard unprivileged users. This issue arises from a logic flaw in KubeVirt's hostDisk feature implementation, specifically in the DiskOrCreate option that automatically creates files on the host if they don't already exist. The hostDisk feature is designed to allow mounting host files or directories owned by user UID 107 into a virtual machine, but the vulnerable code fails to properly validate and enforce ownership constraints during file creation. An attacker with permissions to create VMs and specify hostDisk configurations can exploit this bug to create or access files owned by more privileged users on the Kubernetes host node, effectively bypassing the intended UID 107 restriction. This enables reading sensitive files (such as credentials or configuration data) and writing to privileged locations, potentially leading to further privilege escalation or system compromise.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6 | 7.7 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | High | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat CVSS v3 Score Explanation
PR is High because for Red Hat Openshift virtualization, successful exploitation requires authenticated cluster access with specific RBAC permissions to create VMs using the hostDisk feature. These capabilities are restricted to trusted users in properly configured environments and not available to standard unprivileged users.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
An attacker could read and modify data for which they do not have permissions to access directly.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
