Executive Summary

This vulnerability exists in KubeVirt's safepath package, specifically in the OpenAtNoFollow function. The function attempts to safely obtain a file descriptor to a path leaf without following symbolic links by using O_PATH and O_NOFOLLOW flags. However, downstream helper functions access the file descriptor via /proc/self/fd/N and use system calls that follow symbolic links. As a result, if the path leaf is a symbolic link, the kernel dereferences it, bypassing the intended protection against following symlinks.

An attacker who has access to a virt-launcher pod can exploit this flaw to trick the virt-handler component into applying file ownership or permission changes to an unintended path on the host system, potentially affecting files outside the intended scope.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with access to a virt-launcher pod to cause the virt-handler to modify file ownership or permissions on unintended host paths. This could lead to unauthorized changes to critical files or directories on the host system, potentially compromising system integrity or security.

Because the attacker can influence file permissions or ownership on the host, this may enable privilege escalation, unauthorized access, or disruption of services running on the host.

Useful 0 Not Useful 0