Описание
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
Отчет
The impact of this vulnerability in OpenShift Virtualization is downgraded to Low due to the restrictions of the container environment it runs within. As a restricted user within the context of a restricted container, the external files that could be read or written to would already be accessible by an attacker and limited to within the container. CDI additionally uses memory and CPU limits to prevent uncontrolled resource consumption that could otherwise lead to a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | qemu-kvm | Affected | ||
| Red Hat Enterprise Linux 6 | qemu-kvm | Not affected | ||
| Red Hat Enterprise Linux 7 | qemu-kvm | Not affected | ||
| Red Hat Enterprise Linux 7 | qemu-kvm-ma | Not affected | ||
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:av/qemu-kvm | Affected | ||
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/virt-cdi-operator-rhel9 | Fix deferred | ||
| Advanced Virtualization for RHEL 8.2.1 | virt | Fixed | RHSA-2024:4727 | 23.07.2024 |
| Advanced Virtualization for RHEL 8.4.0.EUS | virt | Fixed | RHSA-2024:4724 | 23.07.2024 |
| Advanced Virtualization for RHEL 8.4.0.EUS | virt-devel | Fixed | RHSA-2024:4724 | 23.07.2024 |
| Red Hat Enterprise Linux 8 | virt-devel | Fixed | RHSA-2024:4420 | 09.07.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
A flaw was found in the QEMU disk image utility (qemu-img) 'info' comm ...
EPSS
7.8 High
CVSS3