| Assigner | redhat |
| Reserved | 2024-05-03 |
| Published | 2024-07-02 |
| Updated | 2024-07-02 |
Description
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Problem types
Uncontrolled Resource Consumption
Product status
17:8.2.0-11.el9_4.4 before *
17:6.2.0-11.el9_0.9 before *
17:7.2.0-14.el9_2.11 before *
Timeline
| 2024-05-02: | Reported to Red Hat. |
| 2024-07-02: | Made public. |
Credits
Red Hat would like to thank Martin Kaesberger for reporting this issue.
References
https://access.redhat.com/errata/RHSA-2024:4276 (RHSA-2024:4276)
https://access.redhat.com/errata/RHSA-2024:4277 (RHSA-2024:4277)
https://access.redhat.com/errata/RHSA-2024:4278 (RHSA-2024:4278)
https://access.redhat.com/security/cve/CVE-2024-4467
https://bugzilla.redhat.com/show_bug.cgi?id=2278875 (RHBZ#2278875)
