CVE-2024-4467: Qemu-kvm: 'qemu-img info' leads to host file read/write
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
Other sources
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service, or read/write to an existing external file.
— Red Hat
Qemu-kvm: 'qemu-img info' leads to host file read/write
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.0-24 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.0-14
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4467?
CVE-2024-4467 has a high severity due to its potential to cause denial of service through excessive resource consumption.
How do I fix CVE-2024-4467?
To fix CVE-2024-4467, update the QEMU software to the latest version that addresses this vulnerability.
What software is affected by CVE-2024-4467?
CVE-2024-4467 affects the QEMU disk image utility, particularly the qemu-img command.
What type of attack is associated with CVE-2024-4467?
CVE-2024-4467 is associated with denial of service attacks through crafted image files.
Is CVE-2024-4467 exploitable remotely?
CVE-2024-4467 may be exploited remotely if an attacker can provide a malicious image file to the qemu-img process.