Description
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | kubevirt-csi-driver | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250313T170021-1.1 | openSUSE-SU-2025:14893-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubevirt/csi-driver | < 0.0.0-202403081943-cc28dcbb0afc14 | 0.0.0-202403081943-cc28dcbb0afc14 | GHSA-fg9q-5cw2-p6r9 |
| Go | github.com/kubevirt/csi-driver | all versions | — | GO-2025-3512 |
Advisories 2
- openSUSE-SU-2025:14893-1 govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1019 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 16, 2024
References
- RHSA-2024:1559 vendor-advisory
- RHSA-2024:1891 vendor-advisory
- RHSA-2024:2047 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-1725 vdb-entry
- RHBZ#2265398 issue-tracking