CVE-2024-33394 kubevirt allows a local attacker to execute arbitrary code via a crafted command
A local attacker can execute arbitrary code in KubeVirt by sending a crafted command to retrieve the token component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33394?
CVE-2024-33394 is a medium-severity code injection vulnerability in n/a, published on 2 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
Weakness: CWE-94
Which versions are affected by CVE-2024-33394?
3 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions | None |
kubevirt.io/kubevirt Go | All versions to 1.2.0 | None |
kubevirt.io/kubevirt Go | All versions to 1.2.0 | None |
Linux distribution packages (6)
kubevirt SUSE:Linux Enterprise Micro 5.5 | All versions | 1.1.1-150500.8.18.1 |
kubevirt SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.1.1-150500.8.18.1 |
kubevirt SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 1.1.1-150600.5.3.2 |
kubevirt openSUSE:Leap 15.5 | All versions | 1.1.1-150500.8.18.1 |
kubevirt openSUSE:Leap 15.6 | All versions | 1.1.1-150600.5.3.2 |
kubevirt openSUSE:Tumbleweed | All versions | 1.2.2-2.1 |
Products include Kubevirt Kubevirt.
How do I fix CVE-2024-33394?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-33394 being exploited?
There is no known exploitation of CVE-2024-33394 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
Sources
Also known as AZL-64787, AZL-64791, GHSA-4q63-mr2m-57hf, GO-2024-2816, MINI-2g58-mm6j-mr7r, MINI-m52v-36g6-m7j9 and 3 more.