Bug 1848951 (CVE-2020-14316)

Summary:	CVE-2020-14316 kubevirt: VMIs can be used to access host files
Product:	[Other] Security Response	Reporter:	Stoyan Nikolov <snikolov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	cnv-qe-bugs, danken, dfediuck, dvossel, fdeutsch, jlejosne, ncredi, security-response-team, sgott
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kubevirt 0.30	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-28 19:28:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1850033, 1852303
Bug Blocks:	1848931

Description Stoyan Nikolov 2020-06-19 11:02:12 UTC

Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem.
Upstream fix: https://github.com/kubevirt/kubevirt/pull/3686

Comment 4 Stoyan Nikolov 2020-07-06 07:09:48 UTC

Acknowledgments:

Name: Fabian Deutsch (Red Hat)

Comment 9 errata-xmlrpc 2020-07-28 19:07:32 UTC

This issue has been addressed in the following products:

  RHEL-8-CNV-2.4
  RHEL-7-CNV-2.4

Via RHSA-2020:3194 https://access.redhat.com/errata/RHSA-2020:3194

Comment 10 Product Security DevOps Team 2020-07-28 19:28:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14316

Comment 15 Stoyan Nikolov 2020-07-30 08:03:25 UTC

Mitigation:

This flaw can be partially or completely mitigated by leveraging existing mechanisms to restrict the VMI process such as running as non-root and using SELinux and sVirt whenever possible.

Comment 17 Stoyan Nikolov 2020-07-30 08:20:36 UTC

Statement:

OpenShift Virtualization 1.4 and 2.3 use affected version of kubevirt in virt-launcher container, however impact is rated Moderate as VMIs are running as non-root and thus have limited access to the host's filesystem.