Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-64433— KubeVirt Arbitrary Container File Read

Quick assessment

Affected
kubevirt kubevirt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kubevirt是KubeVirt开源的一款虚拟机管理器。 KubeVirt 1.5.3之前版本和1.6.1之前版本存在路径遍历漏洞，该漏洞源于符号链接处理不当和文件所有权更改问题，可能导致读取virt-launcher pod文件系统中的任意文件。

CVSS 6.5 · Medium EPSS 0.48% · P40
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-64433

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KubeVirt Arbitrary Container File Read
Source: CVE Program / CVE List V5
Vulnerability Description
KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM. Specifically, if a malicious user has full or partial control over the contents of a PVC, they can create a symbolic link that points to a file within the virt-launcher pod's file system. Since libvirt can treat regular files as block devices, any file on the pod's file system that is symlinked in this way can be mounted into the VM and subsequently read. Although a security mechanism exists where VMs are executed as an unprivileged user with UID 107 inside the virt-launcher container, limiting the scope of accessible resources, this restriction is bypassed due to a second vulnerability. The latter causes the ownership of any file intended for mounting to be changed to the unprivileged user with UID 107 prior to mounting. As a result, an attacker can gain access to and read arbitrary files located within the virt-launcher pod's file system or on a mounted PVC from within the guest VM. This vulnerability is fixed in 1.5.3 and 1.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Kubevirt 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kubevirt是KubeVirt开源的一款虚拟机管理器。 KubeVirt 1.5.3之前版本和1.6.1之前版本存在路径遍历漏洞，该漏洞源于符号链接处理不当和文件所有权更改问题，可能导致读取virt-launcher pod文件系统中的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
kubevirt kubevirt < 1.5.3 -

II. Public POCs for CVE-2025-64433

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-64433

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-64433 (1)

Vendor Advisories for CVE-2025-64433 (1)

Same Patch Batch · kubevirt · 2025-11-07 · 6 CVEs total

CVE-2025-64435 5.3 MEDIUM KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation
CVE-2025-64437 5.0 MEDIUM KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
CVE-2025-64432 4.7 MEDIUM KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
CVE-2025-64434 4.7 MEDIUM KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
CVE-2025-64436 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

IV. Related Vulnerabilities

Same product: kubevirt
Same vendor: kubevirt
Same weakness: CWE-22

V. Comments for CVE-2025-64433

No comments yet

Leave a comment