GHSA-828r-r2c8-rfw3

Suggest an improvement
Source
https://github.com/advisories/GHSA-828r-r2c8-rfw3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-828r-r2c8-rfw3/GHSA-828r-r2c8-rfw3.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-828r-r2c8-rfw3
Aliases
Published
2024-04-24T20:54:37Z
Modified
2024-06-04T16:58:46.726706Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Privilege Escalation in kubevirt
Details

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Database specific
{
    "nvd_published_at": "2020-07-29T19:15:00Z",
    "cwe_ids": [
        "CWE-269"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T20:54:37Z"
}
References

Affected packages

Go / kubevirt.io/kubevirt

Package

Name
kubevirt.io/kubevirt
View open source insights on deps.dev
Purl
pkg:golang/kubevirt.io/kubevirt

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.30.0