Описание
Security update for kubevirt1.9
This update for kubevirt1.9 fixes the following issues:
- CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host (bsc#1272840).
- CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286984).
- CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287039).
- CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287143).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285255).
- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287446).
Update to version 1.9.1:
- virt-template is pinned at v0.2.3
- several bug fixes, see https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1272840
- SUSE Bug 1285255
- SUSE Bug 1286984
- SUSE Bug 1287039
- SUSE Bug 1287143
- SUSE Bug 1287446
- SUSE CVE CVE-2026-13622 page
- SUSE CVE CVE-2026-78659 page
- SUSE CVE CVE-2026-78660 page
- SUSE CVE CVE-2026-78663 page
- SUSE CVE CVE-2026-78669 page
- SUSE CVE CVE-2026-97032 page
Описание
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
Затронутые продукты
Ссылки
- CVE-2026-13622
- SUSE Bug 1272840
Описание
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
Затронутые продукты
Ссылки
- CVE-2026-78659
- SUSE Bug 1284768
- SUSE Bug 1286134
Описание
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Затронутые продукты
Ссылки
- CVE-2026-78660
- SUSE Bug 1284769
- SUSE Bug 1286129
Описание
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Затронутые продукты
Ссылки
- CVE-2026-78663
- SUSE Bug 1284770
- SUSE Bug 1286126
Описание
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Затронутые продукты
Ссылки
- CVE-2026-78669
- SUSE Bug 1284772
Описание
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
Затронутые продукты
Ссылки
- CVE-2026-97032
- SUSE Bug 1284780
- SUSE Bug 1286108