Executive Summary

This vulnerability in KubeVirt versions 1.5.0 and earlier involves excessive permissions granted to the virt-handler service account. These permissions, such as updating Virtual Machine Instances (VMI) and patching nodes, can be exploited by an attacker to force a VMI migration to a node controlled by the attacker. Additionally, the attacker could mark all nodes as unschedulable, potentially forcing migration or creation of privileged pods onto a compromised node.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to manipulate the scheduling and migration of virtual machines within a Kubernetes cluster, potentially directing workloads to attacker-controlled or compromised nodes. This could lead to unauthorized access, privilege escalation, or disruption of services by forcing privileged pods onto compromised nodes.

Useful 0 Not Useful 0