title: Kubevirt-csi: persistentvolume allows access to hcp's root node
description: A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
problem types: Trust Boundary Violation
affected:
{
product: kubevirt-csi
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.15
collectionURL: https://catalog.redhat.com/software/containers/
packageName: openshift4/kubevirt-csi-driver-rhel8
defaultStatus: affected
versions:
version: v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:openshift:4.15::el8, cpe:/a:redhat:openshift:4.15::el9]
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]