Permissions, Privileges, and Access Controls in Kubevirt - CVE-2024-33394

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU93867

Permissions, Privileges, and Access Controls in Kubevirt - CVE-2024-33394

Published: July 8, 2024


Vulnerability identifier: #VU93867
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-33394
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to application does not properly impose security restrictions. A local user can obtain all secrets in the cluster and compromise it.


Affected software

Kubevirt
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
Containers Module
openSUSE Leap
kubevirt-pr-helper-conf
kubevirt-virt-exportserver
kubevirt-virt-api-debuginfo
kubevirt-virt-controller
kubevirt-virtctl-debuginfo
kubevirt-virt-operator-debuginfo
kubevirt-virt-operator
kubevirt-virt-api
kubevirt-container-disk-debuginfo
kubevirt-virt-controller-debuginfo
kubevirt-virt-exportproxy-debuginfo
kubevirt-tests-debuginfo
kubevirt-virt-launcher
kubevirt-container-disk
kubevirt-tests
obs-service-kubevirt_containers_meta
kubevirt-virtctl
kubevirt-manifests
kubevirt-virt-launcher-debuginfo
kubevirt-virt-handler-debuginfo
kubevirt-virt-handler
kubevirt-virt-exportserver-debuginfo
kubevirt-virt-exportproxy

How to mitigate CVE-2024-33394

Install updates from vendor's website.

Kubevirt - update to 1.2.1
kubevirt-pr-helper-conf - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-exportserver - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-api-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-controller - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virtctl-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-operator-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-operator - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-api - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-container-disk-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-controller-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-exportproxy-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-tests-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-launcher - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-container-disk - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-tests - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
obs-service-kubevirt_containers_meta - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virtctl - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-manifests - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-launcher-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-handler-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-handler - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-exportserver-debuginfo - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2
kubevirt-virt-exportproxy - addressed in versions 1.1.1-150500.8.18.1, 1.1.1-150600.5.3.2

External References

Related Security Bulletins