A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user
    able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable
    or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible. (CVE-2022-1798)

The version of kubevirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1798 advisory.

  - A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user     able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable     or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible. (CVE-2022-1798)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3333-1 advisory.

    The kubevirt stack was updated to version 0.54.0

    Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0

    Security fixes:

    - CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516)

    Security fixes in vendored dependencies:

    - CVE-2022-1996: Fixed go-restful CORS bypass bsc#1200528)
    - CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration     (bsc#1199460)

    - Fix containerdisk unmount logic
    - Support topology spread constraints
    - Update libvirt-go to fix memory leak
    - Pack nft rules and nsswitch.conf for virt-handler
    - Only create 1MiB-aligned disk images (bsc#1199603)
    - Avoid to return nil failure message
    - Use semantic equality comparison
    - Drop kubevirt-psp-caasp.yaml
    - Allow to configure utility containers for update test
    - Symlink nsswitch.conf and nft rules to proper locations
    - Drop unused package libvirt-client
    - Install vim-small instead of vim
    - Remove unneeded libvirt-daemon-driver-storage-core
    - Install missing packages ethtool and gawk. Fixes bsc#1199392

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3321-1 advisory.

    Security issues fixed:

    - CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516)

    Security issues fixed in vendored dependencies:

    - CVE-2022-1996: Fixed go-restful CORS bypass (bsc#1200528)
    - CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration     (bsc#1199460)

    Other fixes:

    - Pack nft rules and nsswitch.conf for virt-handler
    - Only create 1MiB-aligned disk images (bsc#1199603)
    - Avoid to return nil failure message
    - Use semantic equality comparison
    - Allow to configure utility containers for update test
    - Install nftables to manage network rules
    - Install tar to allow kubectl cp ...
    - Symlink nsswitch.conf and nft rules to proper locations
    - Enable USB redirection support for QEMU
    - Install vim-small instread of vim
    - Drop libvirt-daemon-driver-storage-core
    - Install ethtool and gawk (bsc#1199392)
    - Use non-versioned appliance to avoid redundant rpm query
    - Explicitly state the dependency on kubevirt main package

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
414123	SCA: security update for kubevirt.io/kubevirt (GHSA-cvx8-ppmc-78hm)	Tenable Cloud Security	SCA Checks	Local	medium
414123	SCA: security update for kubevirt.io/kubevirt (GHSA-cvx8-ppmc-78hm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
173492	CBL Mariner 2.0 Security Update: kubevirt (CVE-2022-1798)	Nessus	MarinerOS Local Security Checks	Local	medium
165333	SUSE SLES15: kubevirt-container-disk / kubevirt-manifests / kubevirt-tests / etc (SUSE-SU-2022:3333-1)	Nessus	SuSE Local Security Checks	Local	critical
165293	SUSE SLES15: kubevirt-container-disk / kubevirt-manifests / kubevirt-tests / etc (SUSE-SU-2022:3321-1)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-1798

medium

Tenable Plugins

medium

medium

medium

critical

critical