Huzaifa Sidhpurwala

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A symlink following issue exists in the KubeVirt `virt-handler` migration proxy. During live migration, `virt-handler` uses `net.Dial()` to connect to Unix sockets within the target `virt-launcher` pod via `/proc/<pid>/root/` paths without implementing symlink protection. Since these socket paths are located in directories owned by qemu and writable by the `virt-launcher` user, an attacker with namespace edit and `pods/exec` permissions can replace a migration proxy socket with a symlink pointing to the host CRI-O socket. Because `virt-handler` operates as root within the host mount namespace, absolute symlink targets are resolved against the host filesystem. The bidirectional `io.Copy` proxy then relays attacker-controlled data to the container runtime, which can lead to full node compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt versions 1.8.0 and later **Description** A flaw exists in the network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the `networkName` value is written directly into the launcher pod's `v1.multus-cni.io/default-network` annotation without proper format validation or sanitization. While empty strings are rejected, the system fails to perform DNS-1123 format validation, JSON detection, or special character rejection. If the `ExternalNetResourceInjection` Beta feature gate is enabled, the Network Attachment Definition (NAD) lookup is skipped. This allows a tenant with `kubevirt.io:edit` permissions to inject a JSON-formatted `NetworkSelectionElement` array. Consequently, Multus may attach the launcher pod to a specified network attachment in any namespace, leading to cross-namespace network access and IP/MAC impersonation on segregated network segments. **Recommendations** Disable the `ExternalNetResourceInjection` Beta feature gate to prevent the bypass of NAD lookups. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A flaw exists in the migration proxy where setting `spec.configuration.migrations.disableTLS` to true on the KubeVirt custom resource causes the target virt-handler to bind a plain TCP listener on all interfaces (0.0.0.0/::) using a random port. This listener lacks authentication, peer allow-lists, or handshake tokens, and proxies directly into the target virt-launcher's virtqemud control socket. An attacker with a pod on the cluster network can connect to this listener to execute unfiltered libvirt RPC commands against another tenant's virtual machine. Potential impacts include reading VM memory and configuration, modifying VM state via QMP (QEMU Machine Protocol), or destroying the VM. Configuring a dedicated migration network via `migrations.network` does not mitigate this, as the listener bind address remains 0.0.0.0. **Recommendations** Avoid setting the `spec.configuration.migrations.disableTLS` parameter to true to ensure mutual authentication and encryption remain enabled for migrations.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A flaw exists in the downward metrics virtio-serial server. The server utilizes the `textproto.Reader.ReadLine()` function to read guest requests, which buffers input indefinitely until a newline character is encountered, lacking both a length limit and a read deadline. An attacker with access to a VM guest configured with the downward metrics virtio-serial device can send a continuous byte stream to the device. This results in unbounded memory allocation within the `virt-handler` process, leading to an Out-Of-Memory (OOM) condition that kills the process and causes a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A flaw exists in the network cache handling of KubeVirt's virt-handler. The `WriteToCachedFile()` function writes data to a launcher-rooted path using `os.WriteFile` and `os.Chown` without symlink protection. A user with access to the virt-launcher container can create a symlink at the cache file path, which causes virt-handler to follow the link, overwrite an arbitrary host file with JSON content, and change the file ownership. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A server-side request forgery (SSRF) flaw exists in the `virt-api` port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), `virt-api` retrieves the target IP from `vmi.Status.Interfaces[0].IP` and passes it to the `net.Dial()` function without validation. For VMIs using non-masquerade network bindings, such as bridge or secondary-only, this IP is reported by the QEMU guest agent within the VM and can be controlled by the VM owner. An attacker with `kubevirt.io:edit` permissions can configure a VM with a modified guest agent to report an arbitrary IP address. By requesting a port-forward, the attacker can establish a bidirectional TCP tunnel from the cluster-internal network position of `virt-api` to any routable destination, effectively bypassing NetworkPolicy isolation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A flaw exists in the KubeVirt virt-handler domain notify server. The gRPC handlers `HandleDomainEvent()` and `HandleK8SEvent()` determine the VMI identity (namespace/name) based only on the request body, failing to validate it against the connection origin. Because no identity tag is propagated from the per-VMI pipe socket used by each virt-launcher pod to the server handlers, a compromised virt-launcher process can send forged domain lifecycle events for any other VMI on the same node. This leads to the virt-handler incorrectly updating the state of the targeted VMI and disrupting its lifecycle management. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A flaw exists in the `safepath` package used by `virt-handler`. The `OpenAtNoFollow()` function utilizes `O PATH|O NOFOLLOW` to obtain a file descriptor for a path leaf; however, subsequent operations resolve the path via `/proc/self/fd/N` using syscalls that follow links. If the leaf is a symlink, the kernel dereferences it, bypassing the intended protection. An attacker with access to a `virt-launcher` pod can exploit this to redirect `virt-handler` IPC socket connections, such as the notify socket for VM domain lifecycle events. This allows the injection of arbitrary domain events, which can lead to incorrect lifecycle actions, corruption of VM state in the Kubernetes API, or a crash, causing a denial of VM management services for all virtual machines on the node. Furthermore, this flaw enables `virt-handler` to apply file ownership or permission changes to unintended host paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pacemaker versions prior to 1.1.24-rc1 Pacemaker versions prior to 2.0.5-rc2 **Description** The issue is related to an ACL bypass flaw in Pacemaker, which could allow an attacker with a local account on the cluster and in the haclient group to use IPC communication with various daemons directly, performing tasks that would be prevented by ACLs if they went through the configuration. This could potentially lead to unauthorized access to confidential information or cause a denial of service. **Recommendations** For Pacemaker versions prior to 1.1.24-rc1, update to version 1.1.24-rc1 or later to resolve the issue. For Pacemaker versions prior to 2.0.5-rc2, update to version 2.0.5-rc2 or later to resolve the issue. As a temporary workaround, consider restricting access to the haclient group and limiting IPC communication with daemons to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 52.7.2 Firefox versions prior to 59.0.1 **Description** The issue is related to the libtremor library, which has a flaw similar to a previously known issue. This library is utilized by Firefox on Android and ARM platforms as a replacement for libvorbis. **Recommendations** For Firefox ESR versions prior to 52.7.2, update to version 52.7.2 or later. For Firefox versions prior to 59.0.1, update to version 59.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** libevent versions prior to 2.1.6-beta **Description** The issue is related to a stack-based buffer overflow in the `evutil parse sockaddr port` function, which can be exploited by attackers to cause a denial of service, resulting in a segmentation fault. This can be achieved by providing a long string in brackets in the `ip as string` argument. The vulnerability allows remote attackers to disrupt service. **Recommendations** For versions prior to 2.1.6-beta, update to version 2.1.6-beta or later to resolve the issue. As a temporary workaround, consider restricting input to the `evutil parse sockaddr port` function to prevent long strings in brackets from being processed.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions prior to 1.0.1o OpenSSL versions prior to 1.0.2c **Description** The issue is caused by a buffer overflow in the ASN.1 implementation, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted ANY field in serialized data. This can lead to memory corruption. The vulnerability is related to the misinterpretation of large universal tags as negative zero values in ANY structures. **Recommendations** For versions prior to 1.0.1o, update to version 1.0.1o or later. For versions prior to 1.0.2c, update to version 1.0.2c or later. As a temporary workaround, consider restricting the use of the `d2i ASN1 TYPE` function until a patch is available. Avoid deserializing untrusted ASN.1 structures containing an ANY field to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Squid versions 3.4.4 through 3.4.11 Squid versions 3.5.0.1 through 3.5.1 **Description** The issue allows remote authenticated users to retain access by leveraging a stale nonce when Digest authentication is used. **Recommendations** For Squid versions 3.4.4 through 3.4.11, update to a version outside of this range to resolve the issue. For Squid versions 3.5.0.1 through 3.5.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling Digest authentication until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libtar versions prior to 1.2.20 **Description** The issue is related to multiple integer overflows in the `th read` function in `lib/block.c` in libtar, which can lead to a denial of service (crash) and possibly allow remote attackers to execute arbitrary code via a long name or link in an archive, triggering a heap-based buffer overflow. Exploitation of this issue can be done remotely and may result in the disruption of confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 1.2.20, update to version 1.2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the `th read` function in `lib/block.c` until a patch is available. Avoid using long names or links in archives to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MySQL versions 5.5.19 and possibly other versions MariaDB versions 5.5.28a and possibly other versions **Description** The issue allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator, when configured to assign the FILE privilege to users who should not have administrative privileges. The vendor disputes this issue, stating that it is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. **Recommendations** For MySQL version 5.5.19, consider restricting the FILE privilege to only administrative users. For MariaDB version 5.5.28a, consider restricting the FILE privilege to only administrative users. As a temporary workaround, consider disabling the assignment of the FILE privilege to non-administrative users until a proper configuration is in place. Restrict access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle MySQL versions 5.5.38 and earlier Oracle MySQL versions 5.6.19 and earlier MariaDB versions 5.5.28a and earlier MariaDB version 5.3.11 MariaDB version 5.2.13 MariaDB version 5.1.66 **Description** The issue allows remote attackers to enumerate valid usernames by generating different error messages with different time delays depending on whether a user name exists. **Recommendations** For Oracle MySQL versions 5.5.38 and earlier, update to a version later than 5.5.38 to resolve the issue. For Oracle MySQL versions 5.6.19 and earlier, update to a version later than 5.6.19 to resolve the issue. For MariaDB versions 5.5.28a and earlier, consider updating to a newer version to mitigate the risk. For MariaDB version 5.3.11, consider updating to a newer version to mitigate the risk. For MariaDB version 5.2.13, consider updating to a newer version to mitigate the risk. For MariaDB version 5.1.66, consider updating to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the user enumeration functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle MySQL versions 5.5.19 through 5.5.28 MariaDB versions 5.5.28a and possibly other versions **Description** A heap-based buffer overflow issue allows remote authenticated users to cause a denial of service, resulting in memory corruption and crash, and possibly execute arbitrary code. This can be demonstrated using various database commands, including `USE`, `SHOW TABLES`, `DESCRIBE`, `SHOW FIELDS FROM`, `SHOW COLUMNS FROM`, `SHOW INDEX FROM`, `CREATE TABLE`, `DROP TABLE`, `ALTER TABLE`, `DELETE FROM`, `UPDATE`, and `SET PASSWORD`. **Recommendations** For Oracle MySQL versions 5.5.19 through 5.5.28, update to a version outside of this range to resolve the issue. For MariaDB versions 5.5.28a and possibly other versions, consider restricting access to the affected database commands as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle MySQL versions 5.1.53 through 5.1.66 Oracle MySQL versions 5.5.19 through 5.5.28 MariaDB versions 5.1.x through 5.1.66 MariaDB versions 5.2.x through 5.2.13 MariaDB versions 5.3.x through 5.3.11 MariaDB versions 5.5.2.x through 5.5.28a **Description** The issue is a stack-based buffer overflow in the `acl get` function, allowing remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command. **Recommendations** For Oracle MySQL versions 5.1.53 through 5.1.66, update to a version later than 5.1.66. For Oracle MySQL versions 5.5.19 through 5.5.28, update to a version later than 5.5.28. For MariaDB versions 5.1.x through 5.1.66, update to a version later than 5.1.66. For MariaDB versions 5.2.x through 5.2.13, update to a version later than 5.2.13. For MariaDB versions 5.3.x through 5.3.11, update to a version later than 5.3.11. For MariaDB versions 5.5.2.x through 5.5.28a, update to a version later than 5.5.28a.

**Name of the Vulnerable Software and Affected Versions** dracut versions in Red Hat Enterprise Linux 6, Fedora 16 and 17 **Description** The issue allows local users to potentially obtain sensitive information due to world-readable permissions in initramfs images created by dracut.sh. **Recommendations** For Red Hat Enterprise Linux 6, consider changing the permissions of initramfs images to prevent world-readable access. For Fedora 16 and 17, restrict access to the initramfs images until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** OpenJPEG versions prior to 1.5.1 Gentoo Linux (affected versions not specified) **Description** The issue concerns multiple vulnerabilities in the OpenJPEG package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, a heap-based buffer overflow in OpenJPEG 1.5.0 and earlier versions allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file. **Recommendations** For OpenJPEG versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue. For Gentoo Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.