CVE-2024-45310, CVE-2025-22872, CVE-2025-64324 +5 more CVEs: kubevirt before 1.6.1 (exclusive), 1.7.0 · update alpha0, 1.7.0 · update beta0 (+1 more affected…

CVE-2024-45310

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2025-22872

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

CVE-2025-64324

Affected technology

kubevirt · before 1.6.1 (exclusive)
kubevirt

kubevirt · 1.7.0 · update alpha0
kubevirt

kubevirt · 1.7.0 · update beta0
kubevirt

kubevirt · 0 to before 1.6.1, 1.7.0-alpha.0 to before 1.7.0-rc.0
kubevirt

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

The source says however, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality and integrity impact as high; availability impact as none.

CVE-2025-64432

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2025-64433

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2025-64434

Affected technology

KubeVirt Improper TLS Certificate Management Handling · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2025-64435

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2025-64437

Affected technology

KubeVirt Isolation Detection Flaw · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · High privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.