Incorrect Authorization Affecting kubevirt.io/kubevirt package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-KUBEVIRTIOKUBEVIRT-3361719
- published 16 Mar 2023
- disclosed 16 Mar 2023
- credit younaman, XDTG
Introduced: 16 Mar 2023
CVE-2023-26484 Open this link in a new tabHow to fix?
There is no fixed version for kubevirt.io/kubevirt.
Overview
Affected versions of this package are vulnerable to Incorrect Authorization such that if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster.
Workaround
Gatekeeper users can add a webhook which will block the virt-handler service account to modify the spec of a node.