CVE Explorer
CVE-2025-64437
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vuln
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"kubevirt","vendor":"kubevirt","versions":[{"status":"affected","version":"< 1.5.3"},{"status":"affected","version":">= 1.6.0-alpha.0, < 1.6.1"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-59","description":"CWE-59: Improper Link Resolution Before File Access ('Link Following')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c00659afb","tags":["x_refsource_MISC"],"url":"https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c00659afb"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/references/1
{"name":"https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6b","tags":["x_refsource_MISC"],"url":"https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6b"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/references/2
{"name":"https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6a265","tags":["x_refsource_MISC"],"url":"https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6a265"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/references/3
{"name":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-2r4r-5x78-mvqf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-2r4r-5x78-mvqf"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07f98c5b3e771b4ae8568c024414398d38fce8e386c9d80a2ef57f25c31ec7b7 · sha256:abc25d5a8eadb4bc… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.