CVE-2025-1767

What it actually does

The in-tree gitRepo volume allows pods on the same node to clone and access git repositories belonging to other pods without proper isolation, enabling unauthorized read and write access to repository contents across pod boundaries.

Why it matters to the business

Organizations running Kubernetes on affected Red Hat Enterprise Linux 8 systems that still use the deprecated gitRepo volume face risk of data exposure or tampering between workloads on shared nodes, potentially affecting compliance and operational integrity until kernels are updated; the large number of dependent packages increases upgrade scope.

How an attack unfolds

An attacker with high privileges deploys a malicious pod on a node already hosting a target pod using gitRepo volumes, then leverages the volume mechanism to clone and interact with the target's repository, exfiltrating or modifying data due to missing cross-pod isolation in the deprecated feature.

How to fix it

Migrate away from the deprecated in-tree gitRepo volume to CSI driver-based or other supported volume plugins; for Red Hat Enterprise Linux 8 systems update all listed kernel packages to version 0:4.18.0-348.20.1.el8_5 or later.

How to confirm the fix worked

Confirm no pods are using the in-tree gitRepo volume via cluster configuration audits; verify kernel package versions match or exceed 0:4.18.0-348.20.1.el8_5 on all nodes; test pod isolation by attempting cross-pod repository access in a lab environment after changes.

Typical attack path

1. Identify Kubernetes nodes running pods that still rely on the in-tree gitRepo volume
2. Obtain high-privileged access sufficient to schedule a new pod on the same node
3. Deploy attacker-controlled pod configured to use gitRepo volume targeting the victim's repository
4. Clone and access repository contents to read sensitive data or commit unauthorized changes
5. Exfiltrate data or persist modifications without triggering volume-level access controls

How to detect it

Review Kubernetes audit logs and volume mount events for unexpected gitRepo usage patterns across pods on the same node; inspect node-level kernel logs and container runtime events for cross-pod repository clone attempts; correlate with process execution involving git operations from non-owner pods.

What your security team should do

• Immediately inventory all clusters for remaining use of in-tree gitRepo volumes and schedule migration
• Apply the listed kernel package updates to version 0:4.18.0-348.20.1.el8_5 across affected Red Hat Enterprise Linux 8 hosts
• Implement node isolation or taints to reduce co-location of untrusted pods where gitRepo usage cannot be eliminated quickly
• Monitor EPSS trend and re-evaluate exploit maturity as new information emerges