CVE-2024-33394
kubevirt allows a local attacker to execute arbitrary code via a crafted command
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
CVE-2024-33394- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-1417
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
EUVD-2024-1417- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4q63-mr2m-57hf
kubevirt allows a local attacker to execute arbitrary code via a crafted command
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
GHSA-4q63-mr2m-57hf- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
CVE-2024-33394- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
CVE-2024-33394- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-4q63-mr2m-57hf
kubevirt allows a local attacker to execute arbitrary code via a crafted command
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
GHSA-4q63-mr2m-57hf- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
Show 8 moreShow less
OSVAZL-64787 No score
CVE-2024-33394 affecting package kubevirt for versions less than 0.59.0-30
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
AZL-64787- Updated
- 2026-11-02
OSVAZL-64791 No score
CVE-2024-33394 affecting package kubevirt for versions less than 1.5.0-2
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
AZL-64791- Updated
- 2026-11-02
OSVGO-2024-2816 No score
kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt
kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt
- Record
GO-2024-2816- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14058-1 No score
kubevirt-container-disk-1.2.2-2.1 on GA media
These are all security issues fixed in the kubevirt-container-disk-1.2.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14058-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11057-1 No score
kubevirt-1.8-container-disk-1.8.3-1.1 on GA media
These are all security issues fixed in the kubevirt-1.8-container-disk-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11057-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11091-1 No score
kubevirt1.8-container-disk-1.8.3-1.1 on GA media
These are all security issues fixed in the kubevirt1.8-container-disk-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11091-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2246-1 No score
Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container
This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues:
- Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394)
- Ensure procps is installed (provides ps for tests)
This update also rebuilds it against current go releases.
- Record
SUSE-SU-2024:2246-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2318-1 No score
Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container
This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues:
- Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394)
- Ensure procps is installed (provides ps for tests)
Containers were rebuilt against current go and maintenance updates.
- Record
SUSE-SU-2024:2318-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kubevirt.io/kubevirtGo |
through 1.2.0 | None known |
kubevirtAzure Linux:2 |
before 0.59.0-30 | 0.59.0-30 |
kubevirtAzure Linux:3 |
before 1.5.0-2 | 1.5.0-2 |
kubevirt.io/kubevirtGo |
All versions | None known |
kubevirtSUSE:Linux Enterprise Micro 5.5 |
before 1.1.1-150500.8.18.1 | 1.1.1-150500.8.18.1 |
kubevirtSUSE:Linux Enterprise Module for Containers 15 SP5 |
before 1.1.1-150500.8.18.1 | 1.1.1-150500.8.18.1 |
kubevirtopenSUSE:Leap 15.5 |
before 1.1.1-150500.8.18.1 | 1.1.1-150500.8.18.1 |
kubevirtSUSE:Linux Enterprise Module for Containers 15 SP6 |
before 1.1.1-150600.5.3.2 | 1.1.1-150600.5.3.2 |
kubevirtopenSUSE:Leap 15.6 |
before 1.1.1-150600.5.3.2 | 1.1.1-150600.5.3.2 |
kubevirtopenSUSE:Tumbleweed |
before 1.2.2-2.1 | 1.2.2-2.1 |
kubevirt-1.8openSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.8.3-1.1 | 1.8.3-1.1 |
kubevirt1.8openSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.8.3-1.1 | 1.8.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-33394 is a medium vulnerability (CVSS 5.9) in Kubevirt, published May 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in kubevirt 0.59.0-30.
References
gist.github.com/HouqiyuA/1b75e23ece7ad98490aec1c887bdf49b
nvd.nist.gov/vuln/detail/CVE-2024-33394
github.com/advisories/GHSA-4q63-mr2m-57hf
suse.com/support/update/announcement/2024/suse-su-20242246-1
Show 11 moreShow less
bugzilla.suse.com/1223965