CVE-2025-64324
KubeVirt is a virtual machine management add-on for Kubernetes. The hostDisk feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the DiskOrCreate option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
| Software | From | Fixed in |
|---|---|---|
kubevirt.io/kubevirt
|
- | 1.6.1 |
|
kubevirt.io/kubevirt
|
1.7.0-alpha.0 | 1.7.0-rc.0 |
| kubevirt / kubevirt | - | 1.6.1 |
| kubevirt / kubevirt | 1.7.0-alpha0 | 1.7.0-alpha0.x |
| kubevirt / kubevirt | 1.7.0-beta0 | 1.7.0-beta0.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime