Fiche vulnérabilité
CVE-2025-64324 : faille élevée kubevirt kubevirt (CVSS 8.5)
Description
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
En bref
- Sévérité
- Élevée (CVSS 8.5)
- Vecteur CVSS
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Exploitation active
- Non signalée par la CISA
- Publication
- 18 nov. 2025
- Dernière mise à jour
- 26 févr. 2026
Produits concernés
- kubevirt kubevirt