Repository navigation
Scorecard: resolve GO-2025-3512 (kubevirt.io/csi-driver) — not fixable by Renovate #3027
Description
Summary
The OpenSSF Scorecard Vulnerabilities check reports GO-2025-3512 / CVE-2024-1725 — "kubevirt-csi: PersistentVolume allows access to HCP's root node" — against the vendored CSI driver module:
- File:
packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod - Requires:
kubevirt.io/csi-driver v0.0.0-20260424143118-bee6c348c004(pseudo-version)
This is the one advisory of 21 that automation cannot close. Because the Scorecard check is repo-wide and all-or-nothing, the Vulnerabilities score stays at 0/10 until this is resolved, even after #3026 lets Renovate clear the other 20 (x/crypto / x/net / x/sys).
Why Renovate can't handle it
- The OSV record has
introduced: 0and nofixedevent — OSV exposes no fixed version, so there is nothing for Renovate to bump to. - Renovate already fails to resolve the module: the Dependency Dashboard (Dependency Dashboard #2996) shows
Failed to look up go package kubevirt.io/csi-driver: no-result.
What needs deciding (maintainer call)
- Is the pinned commit
bee6c348c004(2026-04-24) actually vulnerable? CVE-2024-1725 is from 2024; the fix may already be present in this much-newer pseudo-version and OSV simply hasn't recorded a fixed-version boundary (common for Go advisories fixed by commit rather than tag). If so → add a justified.osv-scanner.tomlignore (security/false-positiveorsecurity/accepted-risk). - If it is genuinely still vulnerable → bump the vendored
kubevirt.io/csi-driverto a commit that contains the HCP-root-node fix.
Out of scope
Deliberately not silently suppressing this with an .osv-scanner.toml ignore just to green the badge — it's a real PV→root-node privilege escalation and warrants a conscious accept-risk / verify-fixed decision first.
Context
- Companion PR: ci(renovate): bump indirect Go deps and enable OSV vuln alerts #3026 (Renovate automates the other 20 advisories)
- Prior partial fix: fix(deps): bump golang.org/x/crypto to v0.52.0 to close OSV advisories #3019 (root-module x/crypto bump only)
Reacted by dosubot
Activity
lexfrei commentedon Jul 1, 2026
go.modline 94 has areplacedirective pinningkubevirt.io/csi-driverto v0.0.0-20260430151523-51c6bca7c611 (2026-04-30), newer than the bee6c348c004 (2026-04-24) commit this issue cites. The OSV record for GO-2025-3512 has no fixed-version boundary, so whether this is already resolved vs. needs a documented risk-acceptance is a maintainer call. Keeping security/triage-needed pending that decision.lexfrei commentedon Sep 6, 2026
Closing this. govulncheck v1.7.0 (vuln DB 2026-09-02) over main at 86d62bb does not report GO-2025-3512 at all, not even as an unreachable finding.
What resolved it is the replace directive: go.mod points kubevirt.io/csi-driver at github.com/kubevirt/csi-driver v0.0.0-20260624122948-27b52aa22da7, and that is what the build uses. The require line still names the old bee6c348c004 pseudo-version, so grepping go.mod looks like the old dependency is still there. Worth knowing for the next reader. No .osv-scanner.toml was needed and none was added.
Tooling caveat: a govulncheck built against an older Go than the toolchain in PATH cannot analyze the source and prints "file requires newer Go version" instead of a result, so check that the scanner and the toolchain match before trusting a clean run.
The same run flags four unrelated advisories with reachable traces (velero, grpc, x/text, otel). Different problem, separate issue.