CVE-2024-4467
CVE-2024-4467 · Qemu-kvm: 'qemu-img info' leads to host file read/write
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
CVSS 7.8 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
advanced virtualization for rhel 8.2.1
- Versions
- ≥ 8020120240708124623.863bb0db: Not affected (rpm)
No fix published
advanced virtualization for rhel 8.4.0.eus
- Versions
- ≥ 8040020240708093550.522a0ee4: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020240704072441.489197e6: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
- Versions
- ≥ 8040020240703100448.522a0ee4: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 telecommunications update service
- Versions
- ≥ 8040020240703100448.522a0ee4: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 update services for sap solutions
- Versions
- ≥ 8040020240703100448.522a0ee4: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
- Versions
- ≥ 8060020240703092415.ad008a3a: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 telecommunications update service
- Versions
- ≥ 8060020240703092415.ad008a3a: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 update services for sap solutions
- Versions
- ≥ 8060020240703092415.ad008a3a: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 extended update support
- Versions
- ≥ 8080020240703085245.63b34585: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 17:8.2.0-11.el9_4.4: Not affected (rpm)
No fix published
red hat enterprise linux 9.0 update services for sap solutions
- Versions
- ≥ 17:6.2.0-11.el9_0.9: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 extended update support
- Versions
- ≥ 17:7.2.0-14.el9_2.11: Not affected (rpm)
No fix published
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8 advanced virtualization
No fix published
red hat openshift virtualization 4
No fix published
qemu Debian:12
- Versions
- 1:7.2+dfsg-7
- 1:7.2+dfsg-7+deb12u1
- 1:7.2+dfsg-7+deb12u2
- 1:7.2+dfsg-7+deb12u2~bpo11+1
- 1:7.2+dfsg-7+deb12u3
- 1:7.2+dfsg-7+deb12u4
- 1:7.2+dfsg-7+deb12u5
- 1:7.2+dfsg-7+deb12u6
- Affected ranges
- ECOSYSTEM: < 1:7.2+dfsg-7+deb12u7
Update to 1:7.2+dfsg-7+deb12u7
qemu Debian:13
- Affected ranges
- ECOSYSTEM: < 1:9.0.1+ds-1
Update to 1:9.0.1+ds-1
qemu Debian:14
- Affected ranges
- ECOSYSTEM: < 1:9.0.1+ds-1
Update to 1:9.0.1+ds-1
qemu Ubuntu:Pro:20.04:LTS
- Versions
- 1:4.0+dfsg-0ubuntu9
- 1:4.0+dfsg-0ubuntu10
- 1:4.2-1ubuntu1
- 1:4.2-1ubuntu2
- 1:4.2-3ubuntu1
- 1:4.2-3ubuntu2
- 1:4.2-3ubuntu3
- 1:4.2-3ubuntu4
- 1:4.2-3ubuntu5
- 1:4.2-3ubuntu6
- 1:4.2-3ubuntu6.1
- 1:4.2-3ubuntu6.2
- 1:4.2-3ubuntu6.3
- 1:4.2-3ubuntu6.4
- 1:4.2-3ubuntu6.5
- 1:4.2-3ubuntu6.6
- 1:4.2-3ubuntu6.7
- 1:4.2-3ubuntu6.8
- 1:4.2-3ubuntu6.9
- 1:4.2-3ubuntu6.10
- 1:4.2-3ubuntu6.11
- 1:4.2-3ubuntu6.12
- 1:4.2-3ubuntu6.14
- 1:4.2-3ubuntu6.15
- 1:4.2-3ubuntu6.16
- 1:4.2-3ubuntu6.17
- 1:4.2-3ubuntu6.18
- 1:4.2-3ubuntu6.19
- 1:4.2-3ubuntu6.21
- 1:4.2-3ubuntu6.23
- 1:4.2-3ubuntu6.24
- 1:4.2-3ubuntu6.25
- 1:4.2-3ubuntu6.26
- 1:4.2-3ubuntu6.27
- 1:4.2-3ubuntu6.28
- 1:4.2-3ubuntu6.29
- 1:4.2-3ubuntu6.30
- Affected ranges
- ECOSYSTEM: < 1:4.2-3ubuntu6.30+esm1
Update to 1:4.2-3ubuntu6.30+esm1
qemu Ubuntu:22.04:LTS
- Versions
- 1:6.0+dfsg-2expubuntu1
- 1:6.0+dfsg-2expubuntu2
- 1:6.0+dfsg-2expubuntu4
- 1:6.2+dfsg-2ubuntu5
- 1:6.2+dfsg-2ubuntu6
- 1:6.2+dfsg-2ubuntu6.1
- 1:6.2+dfsg-2ubuntu6.2
- 1:6.2+dfsg-2ubuntu6.3
- 1:6.2+dfsg-2ubuntu6.4
- 1:6.2+dfsg-2ubuntu6.5
- 1:6.2+dfsg-2ubuntu6.6
- 1:6.2+dfsg-2ubuntu6.7
- 1:6.2+dfsg-2ubuntu6.8
- 1:6.2+dfsg-2ubuntu6.9
- 1:6.2+dfsg-2ubuntu6.10
- 1:6.2+dfsg-2ubuntu6.11
- 1:6.2+dfsg-2ubuntu6.12
- 1:6.2+dfsg-2ubuntu6.13
- 1:6.2+dfsg-2ubuntu6.14
- 1:6.2+dfsg-2ubuntu6.15
- 1:6.2+dfsg-2ubuntu6.16
- 1:6.2+dfsg-2ubuntu6.17
- 1:6.2+dfsg-2ubuntu6.18
- 1:6.2+dfsg-2ubuntu6.19
- 1:6.2+dfsg-2ubuntu6.21
- 1:6.2+dfsg-2ubuntu6.22
- 1:6.2+dfsg-2ubuntu6.23
- 1:6.2+dfsg-2ubuntu6.24
- 1:6.2+dfsg-2ubuntu6.25
- 1:6.2+dfsg-2ubuntu6.26
- Affected ranges
- ECOSYSTEM: < 1:6.2+dfsg-2ubuntu6.27
Update to 1:6.2+dfsg-2ubuntu6.27
qemu Ubuntu:24.04:LTS
- Versions
- 1:8.0.4+dfsg-1ubuntu3
- 1:8.0.4+dfsg-1ubuntu4
- 1:8.0.4+dfsg-1ubuntu5
- 1:8.1.3+ds-1ubuntu2
- 1:8.2.1+ds-1ubuntu1
- 1:8.2.1+ds-1ubuntu8
- 1:8.2.1+ds-1ubuntu9
- 1:8.2.2+ds-0ubuntu1
- 1:8.2.2+ds-0ubuntu1.2
- 1:8.2.2+ds-0ubuntu1.4
- 1:8.2.2+ds-0ubuntu1.5
- 1:8.2.2+ds-0ubuntu1.6
- 1:8.2.2+ds-0ubuntu1.7
- 1:8.2.2+ds-0ubuntu1.8
- 1:8.2.2+ds-0ubuntu1.9
- Affected ranges
- ECOSYSTEM: < 1:8.2.2+ds-0ubuntu1.10
Update to 1:8.2.2+ds-0ubuntu1.10
Original sources
- https://access.redhat.com/errata/RHSA-2024:4276
- https://access.redhat.com/errata/RHSA-2024:4277
- https://access.redhat.com/errata/RHSA-2024:4278
- https://access.redhat.com/errata/RHSA-2024:4372
- https://access.redhat.com/errata/RHSA-2024:4373
- https://access.redhat.com/errata/RHSA-2024:4374
- https://access.redhat.com/errata/RHSA-2024:4420
- https://access.redhat.com/errata/RHSA-2024:4724
- https://access.redhat.com/errata/RHSA-2024:4727
- https://access.redhat.com/security/cve/CVE-2024-4467
- https://bugzilla.redhat.com/show_bug.cgi?id=2278875
- http://www.openwall.com/lists/oss-security/2024/07/23/2
- https://security.netapp.com/advisory/ntap-20240822-0005/
- https://nvd.nist.gov/vuln/detail/CVE-2024-4467