IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.3Hoch

CVE-2026-13201Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.1… Veröffentlicht: (vor 4 Monaten)

Beschreibung

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Schwachstellentyp (CWE): CWE-61

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
container native virtualization 4.12 —
container native virtualization 4.13 —
container native virtualization 4.14 —
container native virtualization 4.15 —
container native virtualization 4.16 —
container native virtualization 4.17 —
container native virtualization 4.18 —
container native virtualization 4.19 —
container native virtualization 4.20 —
container native virtualization 4.21 —
container native virtualization 4.22 —
kubevirt kubevirt —
redhat openshift virtualization 4 – ≤ 4.22.0
Red Hat Red Hat Container Native Virtualization 4.12 all versions
Red Hat Red Hat Container Native Virtualization 4.13 all versions
Red Hat Red Hat Container Native Virtualization 4.14 all versions
Red Hat Red Hat Container Native Virtualization 4.15 all versions
Red Hat Red Hat Container Native Virtualization 4.16 all versions
Red Hat Red Hat Container Native Virtualization 4.17 all versions
Red Hat Red Hat Container Native Virtualization 4.18 all versions
Red Hat Red Hat Container Native Virtualization 4.19 all versions
Red Hat Red Hat Container Native Virtualization 4.20 all versions
Red Hat Red Hat Container Native Virtualization 4.21 all versions
Red Hat Red Hat Container Native Virtualization 4.22 all versions

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*
  • cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:* ≥ 4 ≤ 4.22.0