CVE-2023-26484

Aliases:GHSA-cp96-jpmq-xrr2
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 15 Mar 2023, 20:40
Last modified:25 Feb 2025, 14:56

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
8.2 HIGH
v3.1 (cve.org)
EPSS Score
0.61% LOW
1% probability +0.28%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Mar 2023, 20:40
Published
Vulnerability first disclosed
25 Feb 2025, 14:56
Last Modified
Vulnerability information updated

Description

KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node.

CVSS Metrics

  • v3.1•HIGH•Score: 8.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.61%• Percentile: 45%

Techniques & Countermeasures

  • CWE-863•Incorrect Authorization

    The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

  • kubevirt.io•kubevirt

    ≤ 0.59.0

  • kubevirt•kubevirt

    ≤ 0.59.0

References (4)