Read the docs
TI-2022-01664 Aliases CVE-2022-1798

Path Traversal vulnerability in Kubevirt

Priority HIGH 71CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Kubevirt (Google LLC): 0.55.1, 0.56.0Red Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleKubevirtbefore 0.55.1; before 0.56.00.55.1, 0.56.0Patch availableCNA
  • Kubevirt VendorGoogle Affected before 0.55.1; before 0.56.0 Fixed in 0.55.1, 0.56.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubevirt:kubevirt:*:*:*:*:*:kubernetes:*:*0.20.0 to before 0.55.1Vulnerablekubevirt
  • cpe:2.3:a:kubevirt:kubevirt:*:*:*:*:*:kubernetes:*:* Versions 0.20.0 to before 0.55.1 Vulnerable ·kubevirt

Remediation

  • Fix · CNA Kubevirt (Google LLC) Fixed in 0.55.1, 0.56.0

Red Hat 5 advisories

  • RHSA-2023:0408 Released 2023-01-25 · Red Hat rating Important
    OpenShift Virtualization 4.12.0 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
  • RHSA-2022:6890 Released 2022-10-11 · Red Hat rating Important
    OpenShift Virtualization 4.8.7 Images bug fixes and security update
    • CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
  • RHSA-2022:6681 Released 2022-09-22 · Red Hat rating Important
    OpenShift Virtualization 4.9.6 Images security and bug fix update
    • CNV 4.9 for RHEL 8 container-native-virtualization/virt-api, container-native-virtualization/virt-artifacts-server, container-native-virtualization/virt-controller +3
Show 2 more Red Hat advisories
  • RHSA-2022:6526 Released 2022-09-14 · Red Hat rating Important
    OpenShift Virtualization 4.11.0 Images security and bug fix update
    • CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
  • RHSA-2022:6351 Released 2022-09-06 · Red Hat rating Important
    OpenShift Virtualization 4.10.5 Images security and bug fix update
    • CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
CNV 4.12 for RHEL 8Fixed RHSA-2023:0408
CNV 4.9 for RHEL 8Fixed RHSA-2022:6681
Not affected: 2 products
  • CNV 4.12 for RHEL 8
  • CNV 4.9 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1798

References

Exploit 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences