CVE-2024-1725: openshift — Fix

Description

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.

Is your site exposed to CVE-2024-1725?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-501 CWE-501

Affected Products

Vendor	Product	Versions
redhat	openshift_container_platform	All
redhat	openshift_container_platform	All
redhat	openshift_container_platform	All
redhat	openshift_container_platform_for_arm64	All
redhat	openshift_container_platform_for_arm64	All
redhat	openshift_container_platform_for_arm64	All
redhat	openshift_container_platform_for_ibm_z	All
redhat	openshift_container_platform_for_ibm_z	All
redhat	openshift_container_platform_for_ibm_z	All
redhat	openshift_container_platform_for_linuxone	All
redhat	openshift_container_platform_for_linuxone	All
redhat	openshift_container_platform_for_linuxone	All
redhat	openshift_container_platform_for_power	All
redhat	openshift_container_platform_for_power	All
redhat	openshift_container_platform_for_power	All

References

Advisories & Patches

https://access.redhat.com/errata/RHSA-2024:1559 https://access.redhat.com/errata/RHSA-2024:1891 https://access.redhat.com/errata/RHSA-2024:2047 https://access.redhat.com/security/cve/CVE-2024-1725 https://access.redhat.com/errata/RHSA-2024:1559 https://access.redhat.com/errata/RHSA-2024:1891 https://access.redhat.com/errata/RHSA-2024:2047 https://access.redhat.com/security/cve/CVE-2024-1725

Other References

https://bugzilla.redhat.com/show_bug.cgi?id=2265398 https://bugzilla.redhat.com/show_bug.cgi?id=2265398

Frequently Asked Questions

What is CVE-2024-1725? +

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-1725? +

CVE-2024-1725 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-1725? +

CVE-2024-1725 affects products from redhat, specifically: openshift_container_platform, openshift_container_platform_for_arm64, openshift_container_platform_for_ibm_z, openshift_container_platform_for_linuxone, openshift_container_platform_for_power. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1725? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-48938 9.8

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified …

CVE-2026-44091 9.1

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new …

CVE-2024-49050 8.8

Visual Studio Code Python Extension Remote Code Execution Vulnerability

CVE-2024-23682 8.2

Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in …

CVE-2025-49714 7.8

Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.

CVE-2026-33828 7.8

Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.

CVE-2024-1725