Permissions, Privileges, and Access Controls in OpenShift Virtualization - CVE-2022-1798

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU67071

Permissions, Privileges, and Access Controls in OpenShift Virtualization - CVE-2022-1798

Published: September 7, 2022


Vulnerability identifier: #VU67071
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1798
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to read arbitrary files on the system.

The vulnerability exists due to a logic issue in kubeVirt API. A remote user can use the kubeVirt API to provide access to host files (like /etc/passwd, for example) in a KubeVirt VM as a disk device that can be written to and read from.

Affected software

OpenShift Virtualization
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
kubevirt-virt-controller-debuginfo
obs-service-kubevirt_containers_meta
kubevirt-virtctl-debuginfo
kubevirt-virtctl
kubevirt-virt-operator-debuginfo
kubevirt-virt-operator
kubevirt-virt-launcher-debuginfo
kubevirt-virt-launcher
kubevirt-virt-handler-debuginfo
kubevirt-virt-handler
kubevirt-virt-controller
kubevirt-virt-api-debuginfo
kubevirt-virt-api
kubevirt-tests-debuginfo
kubevirt-tests
kubevirt-manifests
kubevirt-container-disk-debuginfo
kubevirt-container-disk

How to mitigate CVE-2022-1798

Install updates from vendor's website.

OpenShift Virtualization - addressed in versions 4.10.5, 4.8.7, 4.9.6, 4.11.0, 4.12.0
kubevirt-virt-controller-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
obs-service-kubevirt_containers_meta - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virtctl-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virtctl - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-operator-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-operator - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-launcher-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-launcher - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-handler-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-handler - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-controller - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-api-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-virt-api - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-tests-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-tests - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-manifests - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-container-disk-debuginfo - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2
kubevirt-container-disk - addressed in versions 0.49.0-150300.8.13.1, 0.54.0-150400.3.3.2

External References

Related Security Bulletins