CVE-2024-4467
Qemu-kvm: 'qemu-img info' leads to host file read/write
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Qemu-kvm: 'qemu-img info' leads to host file read/write
| Assigner | redhat |
| Reserved | 2024-05-03 |
| Published | 2024-07-02 |
| Updated | 2024-09-13 |
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Uncontrolled Resource Consumption
| 2024-05-02: | Reported to Red Hat. |
| 2024-07-02: | Made public. |
Red Hat would like to thank Martin Kaesberger for reporting this issue.
https://access.redhat.com/errata/RHSA-2024:4276 (RHSA-2024:4276)
https://access.redhat.com/errata/RHSA-2024:4277 (RHSA-2024:4277)
https://access.redhat.com/errata/RHSA-2024:4278 (RHSA-2024:4278)
https://access.redhat.com/errata/RHSA-2024:4372 (RHSA-2024:4372)
https://access.redhat.com/errata/RHSA-2024:4373 (RHSA-2024:4373)
https://access.redhat.com/errata/RHSA-2024:4374 (RHSA-2024:4374)
https://access.redhat.com/errata/RHSA-2024:4420 (RHSA-2024:4420)
https://access.redhat.com/errata/RHSA-2024:4724 (RHSA-2024:4724)
https://access.redhat.com/errata/RHSA-2024:4727 (RHSA-2024:4727)
https://access.redhat.com/security/cve/CVE-2024-4467
https://bugzilla.redhat.com/show_bug.cgi?id=2278875 (RHBZ#2278875)
