CVE-2025-64437

Aliases:GHSA-2r4r-5x78-mvqfGO-2025-4102
Advisory lineage Upstream: 0 Downstream: 8
Analyzed
Published: 07 Nov 2025, 23:04
Last modified:10 Nov 2025, 18:50

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.21% LOW
0% probability +0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

07 Nov 2025, 23:04
Published
Vulnerability first disclosed
10 Nov 2025, 18:50
Last Modified
Vulnerability information updated

Description

KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 0.21%• Percentile: 11%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • kubevirt.io•kubevirt

    < 1.5.3 | ≥ 1.6.0-alpha.0, < 1.6.1 | ≥ 1.6.0-alpha.0, < 1.6.0-beta.0.0.20250801202148-3ce9f41c54d0

  • kubevirt•kubevirt

    ≥ 1.6.0-alpha.0, < 1.6.1 | < 1.5.3 | 1.6.0

References (6)