{"id":"CVE-2024-33394","aliases":["AZL-64787","AZL-64791","EUVD-2024-1417","GHSA-4q63-mr2m-57hf","GO-2024-2816","SUSE-SU-2024:2246-1","SUSE-SU-2024:2318-1","openSUSE-SU-2024:14058-1","openSUSE-SU-2026:11057-1","openSUSE-SU-2026:11091-1"],"status":"published","title":"kubevirt allows a local attacker to execute arbitrary code via a crafted command","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00327,"percentile":0.25982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-05-02T00:00:00Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"Azure Linux:2","package":"kubevirt","fixed_in":["0.59.0-30"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.5.0-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kubevirt","fixed_in":["1.1.1-150500.8.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"kubevirt","fixed_in":["1.1.1-150500.8.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"kubevirt","fixed_in":["1.1.1-150500.8.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"kubevirt","fixed_in":["1.1.1-150600.5.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"kubevirt","fixed_in":["1.1.1-150600.5.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubevirt","fixed_in":["1.2.2-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"kubevirt.io/kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.59.0-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2"}]}]},{"source":"osv","ecosystem":"Go","package":"kubevirt.io/kubevirt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"kubevirt.io/kubevirt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150500.8.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150500.8.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150500.8.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150600.5.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150600.5.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.1"}]}],"bundled":9}],"products":[{"vendor":"kubevirt","product":"kubevirt"}],"references":[{"url":"https://gist.github.com/HouqiyuA/1b75e23ece7ad98490aec1c887bdf49b","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33394","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4q63-mr2m-57hf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33394.json","tags":["advisory"]},{"url":"https://github.com/kubevirt/kubevirt","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223965","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33394","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242318-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9804","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-33394","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T00:00:00Z","modified":"2024-08-02T02:27:53.621Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:21.404483Z"}],"euvd":[{"id":"EUVD-2024-1417","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T00:00:00Z","modified":"2024-08-02T02:27:53Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:22.469918Z"}],"ghsa":[{"id":"GHSA-4q63-mr2m-57hf","title":"kubevirt allows a local attacker to execute arbitrary code via a crafted command ","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T18:30:55Z","modified":"2024-07-03T20:12:43Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2024-33394","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T18:15:07.523Z","modified":"2026-06-17T07:31:43.8Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"CVE-2024-33394","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T00:00:00Z","modified":"2026-10-28T02:30:43.620898661Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-4q63-mr2m-57hf","title":"kubevirt allows a local attacker to execute arbitrary code via a crafted command ","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T18:30:55Z","modified":"2026-09-10T03:50:13.16156984Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"AZL-64787","title":"CVE-2024-33394 affecting package kubevirt for versions less than 0.59.0-30","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T18:15:07Z","modified":"2026-04-21T04:32:33.725818Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-64791","title":"CVE-2024-33394 affecting package kubevirt for versions less than 1.5.0-2","description":"An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T18:15:07Z","modified":"2026-04-21T04:53:05.325782Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"GO-2024-2816","title":"kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt","description":"kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt","status":"published","published":"2024-06-05T15:10:42Z","modified":"2026-06-20T00:59:18.809794728Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14058-1","title":"kubevirt-container-disk-1.2.2-2.1 on GA media","description":"These are all security issues fixed in the kubevirt-container-disk-1.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-20T00:00:00Z","modified":"2026-02-04T02:23:33.208433Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11057-1","title":"kubevirt-1.8-container-disk-1.8.3-1.1 on GA media","description":"These are all security issues fixed in the kubevirt-1.8-container-disk-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-18T00:00:00Z","modified":"2026-06-19T08:15:07.166276407Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11091-1","title":"kubevirt1.8-container-disk-1.8.3-1.1 on GA media","description":"These are all security issues fixed in the kubevirt1.8-container-disk-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:22.313870064Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2024:2246-1","title":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container","description":"This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues:\n\n\n- Collect component Role rules under operator Role instead of\n  ClusterRole (bsc#1223965, CVE-2024-33394)\n- Ensure procps is installed (provides ps for tests)\n\nThis update also rebuilds it against current go releases.\n","status":"published","published":"2024-06-29T06:55:05Z","modified":"2026-02-04T03:35:11.081939Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2318-1","title":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container","description":"This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues:\n\n- Collect component Role rules under operator Role instead of\n  ClusterRole (bsc#1223965, CVE-2024-33394)\n- Ensure procps is installed (provides ps for tests)\n\nContainers were rebuilt against current go and maintenance updates.\n","status":"published","published":"2024-07-08T09:52:12Z","modified":"2026-02-04T04:09:47.2485Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}