CVE-2025-64324

Отчет

This vulnerability is MODERATE because successful exploitation would require authenticated cluster access with specific RBAC permissions to create VMs using the hostDisk feature -capabilities that are restricted to trusted users in properly configured environments and not available to standard unprivileged users. This issue arises from a logic flaw in KubeVirt's hostDisk feature implementation, specifically in the DiskOrCreate option that automatically creates files on the host if they don't already exist. The hostDisk feature is designed to allow mounting host files or directories owned by user UID 107 into a virtual machine, but the vulnerable code fails to properly validate and enforce ownership constraints during file creation. An attacker with permissions to create VMs and specify hostDisk configurations can exploit this bug to create or access files owned by more privileged users on the Kubernetes host node, effectively bypassing the intended UID 107 restriction. This enables reading sensitive files (such as credentials or configuration data) and writing to privileged locations, potentially leading to further privilege escalation or system compromise.