CVE-2025-64324
published 2025-11-18CVE-2025-64324: KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user…
PriorityP345high7.7CVSS 3.1
AVLACLPRNUINSUCHIHAN
EPSS
0.24%
14.9th percentile
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kubevirt.io | kubevirt | >= 0 < 1.6.1 | 1.6.1 |
| kubevirt.io | kubevirt | >= 1.6.2 < 1.7.0-rc.0 | 1.7.0-rc.0 |
| kubevirt.io | kubevirt | >= 1.7.0-alpha.0 < 1.7.0-rc.0 | 1.7.0-rc.0 |
| kubevirt | kubevirt | < 1.6.1 | 1.6.1 |
| kubevirt | kubevirt | — | — |
| kubevirt | kubevirt | — | — |
| kubevirt | kubevirt | >= 1.7.0-alpha.0 < 1.7.0-rc.0 | 1.7.0-rc.0 |
| msrc | azl3_kubevirt_1.5.0-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_kubevirt_1.5.3-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kubevirt_0.59.0-30_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_msrc8.5HIGH
vendor_redhat8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt
osv·2025-11-17
CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt
KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt
KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt
GHSA
KubeVirt Vulnerable to Arbitrary Host File Read and Write
ghsa·2025-11-07
CVE-2025-64324 [HIGH] CWE-123 KubeVirt Vulnerable to Arbitrary Host File Read and Write
KubeVirt Vulnerable to Arbitrary Host File Read and Write
### Summary
The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, the implementation of this feature and more specifically the `DiskOrCreate` option which creates a file if it doesn't exist, has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system.
### Details
The `hostDisk` feature gate in KubeVirt allows mounting a QEMU RAW image directly from the host into a VM. While similar features, such as mounting disk images from a PVC, enforce ownership-based restrictions (e.g., only allowing files owned by specific UID, this mechanism can be subverted. For a RAW disk image to be readable by the QEM
OSV
KubeVirt Vulnerable to Arbitrary Host File Read and Write
osv·2025-11-07
CVE-2025-64324 [HIGH] KubeVirt Vulnerable to Arbitrary Host File Read and Write
KubeVirt Vulnerable to Arbitrary Host File Read and Write
### Summary
The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, the implementation of this feature and more specifically the `DiskOrCreate` option which creates a file if it doesn't exist, has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system.
### Details
The `hostDisk` feature gate in KubeVirt allows mounting a QEMU RAW image directly from the host into a VM. While similar features, such as mounting disk images from a PVC, enforce ownership-based restrictions (e.g., only allowing files owned by specific UID, this mechanism can be subverted. For a RAW disk image to be readable by the QEM
Red Hat
kubevirt.io/kubevirt: KubeVirt: Arbitrary file read/write and privilege escalation via hostDisk feature
vendor_redhat·2025-11-18·CVSS 8.5
CVE-2025-64324 [HIGH] CWE-708 kubevirt.io/kubevirt: KubeVirt: Arbitrary file read/write and privilege escalation via hostDisk feature
kubevirt.io/kubevirt: KubeVirt: Arbitrary file read/write and privilege escalation via hostDisk feature
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
A flaw was found in KubeVirt's hostDisk feature. A logic bug in the DiskOrCreate option, which creates a file if it doesn't exist when mounting host files or directories into a V
Microsoft
KubeVirt Vulnerable to Arbitrary Host File Read and Write
vendor_msrc·2025-11-11·CVSS 8.5
CVE-2025-64324 [HIGH] CWE-200 KubeVirt Vulnerable to Arbitrary Host File Read and Write
KubeVirt Vulnerable to Arbitrary Host File Read and Write
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-18
Published