Path Traversal vulnerability in Kubevirt

Vulnerability

Description

CVE-2022-1798 is a path traversal vulnerability in KubeVirt, a virtual machine management add-on for Kubernetes [2]. The flaw exists in KubeVirt versions up to 0.56 and 0.55.1, and allows a user who can configure a VirtualMachineInstance (VMI) to read arbitrary files from the host filesystem [1][3]. The read operations are limited to files that are publicly readable or readable by UID 107 or GID 107; notably, /proc/self/ is not accessible [3].

Exploitation

Details

An attacker with permission to create VMIs can craft a malicious VMI specification that includes relative path traversal sequences (e.g., test3/../../../../../../../../etc/passwd) in fields such as spec.volumes[*].containerDisk.path [4]. When the VMI is launched, the traversed path is mounted into the virt-launcher pod, making the target host file accessible as a block device inside the VM [3]. Additionally, symlinks placed inside a containerDisk image or hotplugged PVC can achieve the same effect, as the code paths for containerDisk and hotplug share the same mechanism [4].

Impact

Successful exploitation allows an attacker to read sensitive host files, such as /etc/passwd, that are world-readable or readable by UID/GID 107 [3][4]. While the vulnerability does not grant write access and is limited by file permissions, it can be used to gather information about the host system, potentially aiding further attacks. SELinux may provide partial mitigation in environments where it is enforced [3].

Mitigation

The vulnerability was patched in KubeVirt releases after 0.56. Users should upgrade to a fixed version [1][4]. No workaround is available other than upgrading or restricting the ability to create VMIs to trusted users only.