What’s Vulnerable › Vulnerabilities
CVE-2024-1725: Kubevirt-csi: persistentvolume allows access to hcp's root node
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-03-07 · updated 2026-06-17
- Weakness: CWE-501
Description
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Affected products
- Red Hat OpenShift Container Platform 4.18: 4.13, 4.14, 4.15
- RedHat Openshift Container Platform For Arm64: 4.13, 4.14, 4.15
- RedHat Openshift Container Platform For Ibm Z: 4.13, 4.14, 4.15
- RedHat Openshift Container Platform For Linuxone: 4.13, 4.14, 4.15
- RedHat Openshift Container Platform For Power: 4.13, 4.14, 4.15
References
- https://access.redhat.com/errata/RHSA-2024:1559
- https://access.redhat.com/errata/RHSA-2024:1891
- https://access.redhat.com/errata/RHSA-2024:2047
- https://access.redhat.com/security/cve/CVE-2024-1725
- https://bugzilla.redhat.com/show_bug.cgi?id=2265398
- https://access.redhat.com/errata/RHSA-2024:1559
- https://access.redhat.com/errata/RHSA-2024:1891
- https://access.redhat.com/errata/RHSA-2024:2047
- https://access.redhat.com/security/cve/CVE-2024-1725
- https://bugzilla.redhat.com/show_bug.cgi?id=2265398
Get alerted when CVE-2024-1725 or the next vulnerability affects your stack