Bug 2421360 (CVE-2025-14525)

Summary: CVE-2025-14525 kubevirt: kubevirt: VM administration denial of service via guest agent
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fdeutsch, oramraz, security-response-team, smullick, stirabos, thason
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a denial of service for administrative operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-02-02   

Description OSIDB Bzimport 2025-12-11 08:13:58 UTC 
If guest agent is enabled, it reports all the interfaces found in the guest. If there are just enough interfaces to fill up the object capacity on etcd, updates of the VMI may be blocked. This enables the VM user to limit the power of VM admin.

One example of such an exploit may be that the user prevents the admin from setting the network link state from up to down (2 extra characters would be needed).