CVE-2025-64324
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-18
Last Modified
2025-11-25
Generated
2026-06-16
AI Q&A
2025-11-19
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64324
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
kubevirt kubevirt to 1.6.1 (exc)
kubevirt kubevirt 1.7.0
kubevirt kubevirt 1.7.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the KubeVirt virtual machine management add-on for Kubernetes, specifically in the 'hostDisk' feature. Before versions 1.6.1 and 1.7.0, a logic bug in the 'DiskOrCreate' option allowed an attacker to read and write arbitrary files owned by more privileged users on the host system by exploiting the way files are mounted into a VM.

Impact Analysis

The vulnerability can allow an attacker to gain unauthorized read and write access to files owned by more privileged users on the host system. This could lead to data compromise, unauthorized modification of critical files, and potential escalation of privileges within the host environment.

Mitigation Strategies

Upgrade KubeVirt to version 1.6.1 or 1.7.0 or later, as these versions contain the fix for the vulnerability in the hostDisk feature's DiskOrCreate option.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart