We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Bugpilot (Bug tracking)

Ok

THREATINT CVE Home CVE Diag Help
PUBLISHED

CVE-2024-31420

Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes

Reserved:2024-04-03
Published:2024-04-03
Updated:2024-04-03

Description

A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.



MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem types

NULL Pointer Dereference

Product status

4.15.0
unaffected

Default status
affected

Default status
unaffected

Timeline

2024-04-03:Reported to Red Hat.
2024-04-03:Made public.

References

https://access.redhat.com/security/cve/CVE-2024-31420 vdb-entry

https://bugzilla.redhat.com/show_bug.cgi?id=2272951 (RHBZ#2272951) issue-tracking

cve.org CVE-2024-31420

nvd.nist.gov CVE-2024-31420

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-31420