CVE-2025-64324
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-11-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kubevirt | kubevirt | to 1.6.1 (exc) |
| kubevirt | kubevirt | 1.7.0 |
| kubevirt | kubevirt | 1.7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the KubeVirt virtual machine management add-on for Kubernetes, specifically in the 'hostDisk' feature. Before versions 1.6.1 and 1.7.0, a logic bug in the 'DiskOrCreate' option allowed an attacker to read and write arbitrary files owned by more privileged users on the host system by exploiting the way files are mounted into a VM.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to gain unauthorized read and write access to files owned by more privileged users on the host system. This could lead to data compromise, unauthorized modification of critical files, and potential escalation of privileges within the host environment.
What immediate steps should I take to mitigate this vulnerability?
Upgrade KubeVirt to version 1.6.1 or 1.7.0 or later, as these versions contain the fix for the vulnerability in the hostDisk feature's DiskOrCreate option.