CVE-2020-14316

Vulnerability

Overview

A flaw in KubeVirt versions 0.29 and earlier allows Virtual Machine Instances (VMIs) to escape the intended isolation and gain access to the host's filesystem [1]. The root cause is insufficient sandboxing of the VMI process, which runs with elevated privileges relative to the host [2].

Exploitation

An attacker who can create or control a VMI can exploit this vulnerability to break out of the virtual machine and assume the privileges of the VMI process on the host system [1]. No additional authentication is required beyond the ability to deploy a VMI. The attack surface is broadened by the default configuration, though mitigations such as running VMI processes as non-root and enabling SELinux/sVirt can reduce the risk [3].

Impact

Successful exploitation grants the attacker the ability to read and modify any file on the host system, leading to complete compromise of data confidentiality, integrity, and system availability [1]. This represents a critical escalation from VM-level access to full host control.

Mitigation

The vulnerability is addressed in KubeVirt 0.30 by introducing a feature gate for host disk access, which restricts the attack vector [4]. For earlier versions, operators should ensure VMIs run as non-root and leverage SELinux and sVirt to limit filesystem access [3]. OpenShift Virtualization 1.4 and 2.3 are affected but rated Moderate due to non-root execution [3].