Incorrect authorization in Kubevirt - CVE-2023-26484

Vulnerability identifier: #VU75445

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26484

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise the cluster.

The vulnerability exists due to incorrect authorization, which allows the virt-handler service account to modify all node specs. A remote user can elevate privileges beyond the node and gain access to the whole cluster.

Kubevirt
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Containers Module
openSUSE Leap
kubevirt-container-disk-debuginfo
kubevirt-tests
kubevirt-virt-operator-debuginfo
kubevirt-container-disk
kubevirt-virt-handler-debuginfo
kubevirt-virt-launcher-debuginfo
kubevirt-virt-controller-debuginfo
kubevirt-virt-launcher
kubevirt-virt-handler
kubevirt-virtctl
kubevirt-tests-debuginfo
kubevirt-virt-operator
obs-service-kubevirt_containers_meta
kubevirt-virt-controller
kubevirt-virt-api-debuginfo
kubevirt-virt-api
kubevirt-virtctl-debuginfo
kubevirt-manifests

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

kubevirt-container-disk-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-tests - update to 0.54.0-150400.3.13.1
kubevirt-virt-operator-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-container-disk - update to 0.54.0-150400.3.13.1
kubevirt-virt-handler-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-virt-launcher-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-virt-controller-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-virt-launcher - update to 0.54.0-150400.3.13.1
kubevirt-virt-handler - update to 0.54.0-150400.3.13.1
kubevirt-virtctl - update to 0.54.0-150400.3.13.1
kubevirt-tests-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-virt-operator - update to 0.54.0-150400.3.13.1
obs-service-kubevirt_containers_meta - update to 0.54.0-150400.3.13.1
kubevirt-virt-controller - update to 0.54.0-150400.3.13.1
kubevirt-virt-api-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-virt-api - update to 0.54.0-150400.3.13.1
kubevirt-virtctl-debuginfo - update to 0.54.0-150400.3.13.1
kubevirt-manifests - update to 0.54.0-150400.3.13.1

• https://github.com/kubevirt/kubevirt/issues/9109
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-cp96-jpmq-xrr2

• Incorrect authorization in KubeVirt
• SUSE update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container