Permissions Excessives de Rôle dans KubeVirt Pourraient Permettre des Migrations de VMI Non Autorisées Entre Nœuds

Successful exploitation of CVE-2025-64436 could allow an attacker to redirect a VMI to a compromised node, effectively gaining control over the virtual machine's execution environment. This could lead to data breaches, denial of service, or further malicious activities within the Kubernetes cluster. The attacker could potentially leverage this to escalate privileges or pivot to other resources within the cluster. The blast radius extends to any VMs managed by the affected Kubevirt installation, making it a significant security concern for environments relying on virtualized workloads.

Kubernetes clusters utilizing Kubevirt for virtual machine management are at risk. This includes organizations deploying virtualized workloads in production environments, particularly those using older Kubevirt versions prior to 1.7.0. Shared Kubernetes hosting environments where multiple users share the same cluster are also at increased risk.

• linux / server:

journalctl -u kubevirt-operator -g 'virt-handler' | grep -i 'error' -i 'warning'

• generic web:

curl -I <kubevirt_api_endpoint>

Inspect response headers for unusual configurations or unauthorized access attempts. • platform: Examine Kubevirt's admission policies for any deviations from the recommended configurations.

1. 2023-03-23Disclosure

   disclosure

2. 2025-11-06published

   public

1. Réservé2025-11-03
2. Publiée2025-11-06
3. Modifiée2025-11-27
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-64436 is upgrading Kubevirt to version 1.7.0 or later, which includes a ValidatingAdmissionPolicy that restricts modifications to node resources. If upgrading is not immediately feasible, consider implementing a similar policy to restrict the virt-handler service account's ability to modify node specifications. Review and restrict the permissions granted to the virt-handler service account, ensuring it only has the necessary privileges for its intended functions. After upgrading, confirm the policy is correctly applied by attempting to modify node resources with the virt-handler service account and verifying that the modifications are rejected.