CyberRota Analysis
AI-GeneratedKubeVirt's virt-handler migration proxy is vulnerable due to a symlink following issue that allows an attacker with namespace edit and pods/exec permissions to exploit the migration process. By replacing a migration proxy socket with a symlink to the host CRI-O socket, the attacker can leverage the root privileges of virt-handler to gain control over the host filesystem, potentially leading to full node compromise. Organizations using KubeVirt should prioritize addressing this vulnerability to mitigate the risk of severe security breaches.
Original NVD Description
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.