Nanzi Yang

**Name of the Vulnerable Software and Affected Versions** LoadZilla LLC LoadLogic version 1.4.3 **Description** The issue allows a remote attacker to execute arbitrary code via the `LogicLoadEc2DeployLambda` and `CredsGenFunction` functions. This is due to an insecure permissions vulnerability. **Recommendations** For LoadZilla LLC LoadLogic version 1.4.3, as a temporary workaround, consider disabling the `LogicLoadEc2DeployLambda` and `CredsGenFunction` functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fluid versions 0.7.0 through 0.8.5 **Description** The issue is related to improper authorization in Fluid, an open-source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. If a malicious user gains control of a Kubernetes node running the fluid csi pod, they can leverage the fluid-csi service account to modify specs of all nodes in the cluster. However, since this service account lacks `list node` permissions, the attacker may need to use other techniques to identify vulnerable nodes. Once the attacker identifies and modifies the node specs, they can manipulate system-level-privileged components to access all secrets in the cluster or execute pods on other nodes, potentially gaining full privileged access to the whole cluster. To exploit this vulnerability, the attacker can make all other nodes unschedulable and wait for system-critical components with high privilege to appear on the compromised node. **Recommendations** For versions 0.7.0 through 0.8.5, upgrade to version 0.8.6. As a temporary workaround, delete the `csi-nodeplugin-fluid` daemonset in the `fluid-system` namespace and avoid using CSI mode to mount FUSE file systems. Alternatively, use sidecar mode to mount FUSE file systems.

**Name of the Vulnerable Software and Affected Versions** CubeFS versions 3.2.1 and earlier **Description** The issue is related to incorrect permission assignment for a critical resource in CubeFS, a cloud data storage system. This can allow a remote attacker to gain unauthorized access to the device. The vulnerability is associated with Kubernetes cluster-level privilege escalation, which occurs because DaemonSet has the `cfs-csi-cluster-role` and can list all secrets, including the admin secret. **Recommendations** For CubeFS versions 3.2.1 and earlier, consider restricting access to the `cfs-csi-cluster-role` to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of the DaemonSet to prevent it from listing all secrets, including the admin secret. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt versions 0.59.0 and prior **Description** KubeVirt is a virtual machine management add-on for Kubernetes. If a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. **Recommendations** As a temporary workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node. For versions 0.59.0 and prior, consider adding a webhook to block the `virt-handler` service account from modifying node specs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A flaw was found in the 9p passthrough filesystem (9pfs) implementation. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.