x/vulndb: potential Go vuln in github.com/kubevirt/csi-driver: GHSA-fg9q-5cw2-p6r9

[GoVulnBot]

Advisory GHSA-fg9q-5cw2-p6r9 references a vulnerability in the following Go modules:

Module
github.com/kubevirt/csi-driver

Description:
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.

References:

• ADVISORY: GHSA-fg9q-5cw2-p6r9
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-1725
• FIX: kubevirt/csi-driver@cc28dcb
• WEB: https://access.redhat.com/errata/RHSA-2024:1559
• WEB: https://access.redhat.com/errata/RHSA-2024:1891
• WEB: https://access.redhat.com/errata/RHSA-2024:2047
• WEB: https://access.redhat.com/security/cve/CVE-2024-1725
• WEB: https://bugzilla.redhat.com/show_bug.cgi?id=2265398

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/kubevirt/csi-driver
      non_go_versions:
        - fixed: 0.0.0-202403081943-cc28dcbb0afc14
      vulnerable_at: 0.0.0-20250203125309-ae297e73c0ee
summary: 'kubevirt-csi: PersistentVolume allows access to HCP''s root node in github.com/kubevirt/csi-driver'
cves:
    - CVE-2024-1725
ghsas:
    - GHSA-fg9q-5cw2-p6r9
references:
    - advisory: https://github.com/advisories/GHSA-fg9q-5cw2-p6r9
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-1725
    - fix: https://github.com/kubevirt/csi-driver/commit/cc28dcbb0afca0a7cb8a73bc998ab49f864ed560
    - web: https://access.redhat.com/errata/RHSA-2024:1559
    - web: https://access.redhat.com/errata/RHSA-2024:1891
    - web: https://access.redhat.com/errata/RHSA-2024:2047
    - web: https://access.redhat.com/security/cve/CVE-2024-1725
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2265398
source:
    id: GHSA-fg9q-5cw2-p6r9
    created: 2025-03-11T21:01:26.921561693Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/657255 mentions this issue: data/reports: add 7 reports