Skip to content
Fencer Intel
high 8.7

CVE-2022-1798 json

Path Traversal vulnerability in Kubevirt

published 4y ago modified last mo. also GHSA-cvx8-ppmc-78hm , GHSA-qv98-3369-g364 , GO-2022-1000 , EUVD-2022-6544

cvss
8.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

Patch / fix

  • go kubevirt.io/kubevirt 0.55.1
  • Google LLC Kubevirt 0.55.1, 0.56.0
  • kubevirt SLE Module for Containers 15 SP4, openSUSE Leap 15.4 0.54.0-150400.3.3.2
  • kubevirt SLE Module for Containers 15 SP3, openSUSE Leap 15.3 0.49.0-150300.8.13.1

suse advisories SUSE-SU-2022:3333-1SUSE-SU-2022:3321-1

  • kubevirt CBL-Mariner 2.0 0.55.1-1

azure linux advisories AZL-10974

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-1798 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1798 updated cvss 7.7

kubeVirt: Arbitrary file read on the host from KubeVirt VMs

  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-api v4.9.6-9, container-native-virtualization/virt-handler v4.9.6-9, container-native-virtualization/virt-launcher v4.9.6-9, container-native-virtualization/virt-operator v4.9.6-9, container-native-virtualization/virt-controller v4.9.6-9, container-native-virtualization/virt-artifacts-server v4.9.6-9
    fixed: vendor fix RHSA-2022:6681
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virt-api v4.12.0-255, container-native-virtualization/virt-handler v4.12.0-255, container-native-virtualization/virt-launcher v4.12.0-255, container-native-virtualization/virt-operator v4.12.0-255, container-native-virtualization/virt-controller v4.12.0-255, container-native-virtualization/virt-artifacts-server v4.12.0-255
    fixed: vendor fix RHSA-2023:0408
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virtio-win v4.9.6-3, container-native-virtualization/kubemacpool v4.9.6-4, container-native-virtualization/bridge-marker v4.9.6-4, container-native-virtualization/ovs-cni-marker v4.9.6-3, container-native-virtualization/ovs-cni-plugin v4.9.6-3, container-native-virtualization/kubevirt-vmware v4.9.6-3, +24 more Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virtio-win v4.12.0-10, container-native-virtualization/kubemacpool v4.12.0-24, container-native-virtualization/bridge-marker v4.12.0-24, container-native-virtualization/ovs-cni-marker v4.12.0-24, container-native-virtualization/ovs-cni-plugin v4.12.0-24, container-native-virtualization/virt-cdi-cloner v4.12.0-72, +31 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/kubevirt/kubevirt/security/advisories/GHSA-qv98-3369-g364 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go kubevirt.io/kubevirt
>=0.20.0, <0.55.1
0.55.1

Affected products

  • Google LLC Kubevirt

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.