CVE-2024-1725 Kubevirt-csi: persistentvolume allows access to hcp's root node

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane HCP. This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node...

CVE-2024-1725 Kubevirt-csi: persistentvolume allows access to hcp's root node

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane HCP. This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node...

CVE-2024-1725

The CVE-2024-1725 issue affects kubevirt-csi in OpenShift Virtualization’s Hosted Control Plane (HCP): an authenticated attacker can create a PersistentVolume that matches a worker node name to access the root HCP worker node’s volume. Exploitation is described in multiple advisories, with OpenSh...

CVE-2024-1725

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane HCP. This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node...

DEBIAN-CVE-2023-52589

In the Linux kernel, the following vulnerability has been resolved: media: rkisp1: Fix IRQ disable race issue In rkisp1ispstop and rkisp1csidisable the driver masks the interrupts and then apparently assumes that the interrupt handler won't be running, and proceeds in the stop procedure. This is...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: gitsign, pulumi-language-java, kubernetes-csi-external-provisioner, rabbitmq-messaging-topology-operator, gcsfuse, ctop, crossplane-provider-azure, terraform-provider-aws, crossplane-provider-aws-cloudfront, kor, argo-workflows, kubewatch, caddy, hugo-extended, kots,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: temporal-server, kubevela, aws-flb-kinesis, crossplane-provider-aws-cloudformation, crossplane-provider-aws-kms, cluster-proportional-autoscaler, boring-registry, prometheus-elasticsearch-exporter-fips, terraform-provider-azurerm, gcsfuse, kwok, step,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, kubernetes-csi-external-provisioner, govulncheck, gcsfuse, ctop, crossplane-provider-azure, go-licenses, nri-kafka, kor, nri-redis, argo-workflows, kubewatch, caddy, nri-haproxy, prometheus-alertmanager, shfmt, scorecard, gomplate,...

CVE-2021-44716 affecting package csi-driver-lvm for versions less than 0.4.1-15

CVE-2021-44716 affecting package csi-driver-lvm for versions less than 0.4.1-15. A patched version of the package is available...

PT-2024-14634

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises from the rkisp1 isp stop and rkisp1 csi disable functions in the Linux kernel, where the driver masks interrupts and then proceeds with the stop procedure, assuming the...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: gobuster, hey, prometheus-bind-exporter, amass, hubble-ui, gops, nri-discovery-kubernetes, nsc, grpcurl, prometheus-statsd-exporter-fips, stakater-reloader, jsonnet-bundler, aws-flb-kinesis, wait-for-port, configmap-reload, kubeflow-katib, render-template,...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, aws-ebs-csi-driver, prometheus-adapter, spark-operator, nodetaint, aws-efs-csi-driver, aws-efs-csi-driver-fips, ip-masq-agent...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: spark-operator, ip-masq-agent, prometheus-adapter, nodetaint, aws-efs-csi-driver, kubernetes-dns-node-cache...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, aws-ebs-csi-driver, prometheus-adapter, spark-operator, nodetaint, aws-efs-csi-driver, aws-efs-csi-driver-fips, ip-masq-agent...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: cri-tools, envoy-ratelimit, kine, k3s, kubernetes, kubernetes-csi-external-resizer, metrics-server, buildkitd, temporal-server, docker-compose, temporal, kubevela, kubescape, volume-modifier-for-k8s...

Important: Red Hat Bug Fix Advisory: LVMS 4.14.z Bug Fix and Enhancement update

Updated container images that fix multiple bugs are now available for LVMS 4.14.z. Logical volume manager storage LVMS uses the TopoLVM CSI driver to dynamically provision local storage on single node OpenShift clusters. Logical volume manager storage creates thin-provisioned volumes using the...

SUSE CVE-2023-3893

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy...

Privilege Escalation

github.com/kubernetes-csi/csi-proxy is vulnerable to Privilege Escalation. The vulnerability is caused by insufficient input sanitization while constructing different commands from the input string passed to different functions implemented in pkg/os/volume/api.go and pkg/os/volume/api.go. A user...

GHSA-R6CC-7WJ7-GFX2 Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation

Kubernetes is vulnerable to privilege escalation when a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy...

CVE-2023-3893

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy...