~ / search / GHSA-fg9q-5cw2-p6r9

GHSA-fg9q-5cw2-p6r9

kubevirt-csi: PersistentVolume allows access to HCP's root node

Source: GitHub Advisory Database (reviewed) High CVE-2024-1725

Packages

EcosystemPackageAffectedFixed in
Go github.com/kubevirt/csi-driver < 0.0.0-202403081943-cc28dcbb0afc14 0.0.0-202403081943-cc28dcbb0afc14

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.

References

External links from the advisory. They lead to third-party sites.