Executive brief
A security flaw was found in KubeVirt, a tool used to run virtual machines within Kubernetes clusters. An attacker with access to a virtual machine pod could trick the system into changing the ownership or permissions of sensitive files on the underlying host server. This could allow an attacker to gain unauthorized access to host files or disrupt system operations by modifying critical file metadata.
Technical details
A flaw exists in KubeVirt's safepath package, specifically within the OpenAtNoFollow function. While the function uses O_PATH|O_NOFOLLOW to obtain a file descriptor, downstream helpers like ChmodAtNoFollow and ChownAtNoFollow operate via /proc/self/fd/N using syscalls that follow links. If the path leaf is a symlink, the kernel dereferences it at use-time, bypassing intended protections. An attacker with access to a virt-launcher pod can create a symlink targeting host paths; when virt-handler (running as root) performs operations on these paths, it inadvertently modifies the metadata of the targeted host files.
Affected products
- KubeVirt KubeVirt unspecified
- Red Hat OpenShift Virtualization 4 4
Timeline
- 2026-06-24: disclosed: Initial report and NVD publication