Upstream information

CVE-2023-26484 at MITRE

Description

KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node.

SUSE information

Overall state of this security issue: Pending

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database SUSE
Base Score 8.2 8
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector Network Network
Attack Complexity High High
Privileges Required Low High
User Interaction None None
Scope Changed Changed
Confidentiality Impact High High
Integrity Impact High High
Availability Impact None High
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1209359 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise High Performance Computing 15 SP4
SUSE Linux Enterprise Module for Containers 15 SP4
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Manager Proxy 4.3
SUSE Manager Retail Branch Server 4.3
SUSE Manager Server 4.3
  • kubevirt-manifests >= 0.54.0-150400.3.13.1
  • kubevirt-virtctl >= 0.54.0-150400.3.13.1
 Patchnames:
SUSE-SLE-Module-Containers-15-SP4-2023-1967
SUSE Linux Enterprise High Performance Computing 15 SP5
SUSE Linux Enterprise Module for Containers 15 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP5
  • kubevirt-manifests >= 0.58.0-150500.6.3
  • kubevirt-virtctl >= 0.58.0-150500.6.3
 Patchnames:
SUSE Linux Enterprise Module for Containers 15 SP5 GA kubevirt-manifests-0.58.0-150500.6.3
SUSE Linux Enterprise High Performance Computing 15 SP6
SUSE Linux Enterprise Module for Containers 15 SP6
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15 SP6
  • kubevirt-manifests >= 1.1.1-150600.3.6
  • kubevirt-virtctl >= 1.1.1-150600.3.6
 Patchnames:
SUSE Linux Enterprise Module for Containers 15 SP6 GA kubevirt-manifests-1.1.1-150600.3.6
SUSE Linux Enterprise Micro 5.3
  • kubevirt-manifests >= 0.54.0-150400.3.13.1
  • kubevirt-virtctl >= 0.54.0-150400.3.13.1
 Patchnames:
SUSE-SLE-Micro-5.3-2023-1967
SUSE Linux Enterprise Micro 5.4
  • kubevirt-manifests >= 0.54.0-150400.3.13.1
  • kubevirt-virtctl >= 0.54.0-150400.3.13.1
 Patchnames:
SUSE-SLE-Micro-5.4-2023-1967
SUSE Linux Enterprise Micro 6.0
  • kubevirt-manifests >= 1.1.1-2.7
  • kubevirt-virtctl >= 1.1.1-2.7
 Patchnames:
SUSE Linux Enterprise Micro 6.0 GA kubevirt-manifests-1.1.1-2.7
openSUSE Leap 15.4
  • kubevirt-container-disk >= 0.54.0-150400.3.13.1
  • kubevirt-manifests >= 0.54.0-150400.3.13.1
  • kubevirt-tests >= 0.54.0-150400.3.13.1
  • kubevirt-virt-api >= 0.54.0-150400.3.13.1
  • kubevirt-virt-controller >= 0.54.0-150400.3.13.1
  • kubevirt-virt-handler >= 0.54.0-150400.3.13.1
  • kubevirt-virt-launcher >= 0.54.0-150400.3.13.1
  • kubevirt-virt-operator >= 0.54.0-150400.3.13.1
  • kubevirt-virtctl >= 0.54.0-150400.3.13.1
  • obs-service-kubevirt_containers_meta >= 0.54.0-150400.3.13.1
 Patchnames:
openSUSE-SLE-15.4-2023-1967
openSUSE Leap Micro 5.3
  • kubevirt-manifests >= 0.54.0-150400.3.13.1
  • kubevirt-virtctl >= 0.54.0-150400.3.13.1
 Patchnames:
openSUSE-Leap-Micro-5.3-2023-1967
openSUSE Leap Micro 5.4
  • kubevirt-manifests >= 0.54.0-150400.3.13.1
  • kubevirt-virtctl >= 0.54.0-150400.3.13.1
 Patchnames:
openSUSE-Leap-Micro-5.4-2023-1967
openSUSE Tumbleweed
  • kubevirt-container-disk >= 0.59.0-2.1
  • kubevirt-manifests >= 0.59.0-2.1
  • kubevirt-tests >= 0.59.0-2.1
  • kubevirt-virt-api >= 0.59.0-2.1
  • kubevirt-virt-controller >= 0.59.0-2.1
  • kubevirt-virt-exportproxy >= 0.59.0-2.1
  • kubevirt-virt-exportserver >= 0.59.0-2.1
  • kubevirt-virt-handler >= 0.59.0-2.1
  • kubevirt-virt-launcher >= 0.59.0-2.1
  • kubevirt-virt-operator >= 0.59.0-2.1
  • kubevirt-virtctl >= 0.59.0-2.1
  • obs-service-kubevirt_containers_meta >= 0.59.0-2.1
 Patchnames:
openSUSE-Tumbleweed-2024-12792

Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.

Product(s) Source package State
Products under general support and receiving all security fixes.
SUSE Linux Enterprise High Performance Computing 15 SP5 kubevirt Already fixed
SUSE Linux Enterprise Micro 5.3 kubevirt Released
SUSE Linux Enterprise Micro 5.4 kubevirt Released
SUSE Linux Enterprise Micro 5.5 kubevirt Already fixed
SUSE Linux Enterprise Micro for Rancher 5.3 kubevirt Released
SUSE Linux Enterprise Micro for Rancher 5.4 kubevirt Released
SUSE Linux Enterprise Module for Containers 15 SP5 kubevirt Already fixed
SUSE Linux Enterprise Server 15 SP5 kubevirt Already fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5 kubevirt Already fixed
SUSE Manager Proxy 4.3 kubevirt Released
SUSE Manager Retail Branch Server 4.3 kubevirt Released
SUSE Manager Server 4.3 kubevirt Released
openSUSE Leap 15.5 kubevirt Already fixed
openSUSE Leap Micro 5.5 kubevirt Already fixed
Products under Long Term Service Pack support and receiving important and critical security fixes.
SUSE Linux Enterprise High Performance Computing 15 SP2 kubevirt Unsupported
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS kubevirt Unsupported
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kubevirt Affected
SUSE Linux Enterprise High Performance Computing 15 SP3 kubevirt Unsupported
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS kubevirt Unsupported
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kubevirt Unsupported
SUSE Linux Enterprise High Performance Computing 15 SP4 kubevirt Released
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kubevirt Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kubevirt Affected
SUSE Linux Enterprise Module for Containers 15 SP2 kubevirt Unsupported
SUSE Linux Enterprise Module for Containers 15 SP3 kubevirt Unsupported
SUSE Linux Enterprise Module for Containers 15 SP4 kubevirt Released
SUSE Linux Enterprise Server 15 SP2 kubevirt Unsupported
SUSE Linux Enterprise Server 15 SP2-LTSS kubevirt Affected
SUSE Linux Enterprise Server 15 SP3 kubevirt Unsupported
SUSE Linux Enterprise Server 15 SP3-LTSS kubevirt Unsupported
SUSE Linux Enterprise Server 15 SP4 kubevirt Released
SUSE Linux Enterprise Server 15 SP4-LTSS kubevirt Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP2 kubevirt Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP3 kubevirt Unsupported
SUSE Linux Enterprise Server for SAP Applications 15 SP4 kubevirt Released
Products past their end of life and not receiving proactive updates anymore.
SUSE Enterprise Storage 7 kubevirt Affected
SUSE Enterprise Storage 7.1 kubevirt Unsupported
SUSE Linux Enterprise Server 15 SP2-BCL kubevirt Unsupported
SUSE Linux Enterprise Server 15 SP3-BCL kubevirt Unsupported
SUSE Manager Proxy 4.1 kubevirt Unsupported
SUSE Manager Proxy 4.2 kubevirt Unsupported
SUSE Manager Retail Branch Server 4.1 kubevirt Unsupported
SUSE Manager Retail Branch Server 4.2 kubevirt Unsupported
SUSE Manager Server 4.1 kubevirt Unsupported
SUSE Manager Server 4.2 kubevirt Unsupported
openSUSE Leap 15.3 kubevirt Unsupported
openSUSE Leap 15.4 kubevirt Released
openSUSE Leap Micro 5.3 kubevirt Released
openSUSE Leap Micro 5.4 kubevirt Affected
Harvester master
rancher/rancher:v2.9.2 opt/drivers/management-state/bin/docker-machine-driver-harvesterAffected
rancher/harvester-network-controller:master-head usr/bin/harvester-network-controllerAffected
rancher/harvester-network-helper:master-head usr/bin/harvester-network-helperAffected
rancher/harvester-network-webhook:master-head usr/bin/harvester-network-webhookAffected
Harvester v1.2-head
rancher/harvester-pcidevices:v0.2.7 bin/pcidevicesAffected
rancher/rancher:v2.8.2 opt/drivers/management-state/bin/docker-machine-driver-harvester
usr/share/rancher/ui/assets/docker-machine-driver-harvester		Affected
rancher/harvester-network-controller:v0.3.7 usr/bin/harvester-network-controllerAffected
rancher/harvester-network-helper:v0.3.7 usr/bin/harvester-network-helperAffected
rancher/harvester-network-webhook:v0.3.7 usr/bin/harvester-network-webhookAffected
Harvester v1.2.2
rancher/harvester-pcidevices:v0.2.7 bin/pcidevicesAffected
rancher/rancher:v2.8.2 opt/drivers/management-state/bin/docker-machine-driver-harvester
usr/share/rancher/ui/assets/docker-machine-driver-harvester		Affected
rancher/harvester-network-controller:v0.3.7 usr/bin/harvester-network-controllerAffected
rancher/harvester-network-helper:v0.3.7 usr/bin/harvester-network-helperAffected
rancher/harvester-network-webhook:v0.3.7 usr/bin/harvester-network-webhookAffected
Harvester v1.3-head
rancher/rancher:v2.8.5 opt/drivers/management-state/bin/docker-machine-driver-harvester
usr/share/rancher/ui/assets/docker-machine-driver-harvester		Affected
rancher/harvester-network-controller:v0.4.1 usr/bin/harvester-network-controllerAffected
rancher/harvester-network-helper:v0.4.1 usr/bin/harvester-network-helperAffected
rancher/harvester-network-webhook:v0.4.1 usr/bin/harvester-network-webhookAffected
Harvester v1.3.2
rancher/rancher:v2.8.5 opt/drivers/management-state/bin/docker-machine-driver-harvester
usr/share/rancher/ui/assets/docker-machine-driver-harvester		Affected
rancher/harvester-network-controller:v0.4.1 usr/bin/harvester-network-controllerAffected
rancher/harvester-network-helper:v0.4.1 usr/bin/harvester-network-helperAffected
rancher/harvester-network-webhook:v0.4.1 usr/bin/harvester-network-webhookAffected
Rancher v2.8-head
rancher/rancher:v2.8-head opt/drivers/management-state/bin/docker-machine-driver-harvester
usr/share/rancher/ui/assets/docker-machine-driver-harvester		Affected

SUSE Timeline for this CVE

CVE page created: Wed Mar 15 23:00:52 2023
CVE page last modified: Mon Nov 18 14:11:52 2024