// For flags

CVE-2024-4467

Qemu-kvm: 'qemu-img info' leads to host file read/write

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

Se encontró una falla en el comando 'info' de la utilidad de imagen de disco QEMU (qemu-img). Un archivo de imagen especialmente manipulado que contenga un valor `json:{}` que describa los dispositivos de bloque en QMP podría provocar que el proceso qemu-img en el host consuma grandes cantidades de memoria o tiempo de CPU, lo que provocaría una denegación de servicio o lectura/escritura en un archivo externo existente.

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.

*Credits: Red Hat would like to thank Martin Kaesberger for reporting this issue.
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-05-03 CVE Reserved
  • 2024-07-02 CVE Published
  • 2025-05-10 EPSS Updated
  • 2025-05-21 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Exadata Dbserver
Search vendor "Oracle" for product "Exadata Dbserver"
*-
Affected
Oracle
Search vendor "Oracle"
 Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Redhat
Search vendor "Redhat"
 Advanced Virtualization
Search vendor "Redhat" for product "Advanced Virtualization"
*-
Affected
Redhat
Search vendor "Redhat"
 Container Native Virtualization
Search vendor "Redhat" for product "Container Native Virtualization"
*-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel Aus
Search vendor "Redhat" for product "Rhel Aus"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel E4s
Search vendor "Redhat" for product "Rhel E4s"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel Eus
Search vendor "Redhat" for product "Rhel Eus"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel Tus
Search vendor "Redhat" for product "Rhel Tus"
*-
Affected
Alma
Search vendor "Alma"
 Linux
Search vendor "Alma" for product "Linux"
*-
Affected
Amazon
Search vendor "Amazon"
 Linux
Search vendor "Amazon" for product "Linux"
*-
Affected
Huawei
Search vendor "Huawei"
 Euleros
Search vendor "Huawei" for product "Euleros"
*-
Affected
Opensuse
Search vendor "Opensuse"
 Leap
Search vendor "Opensuse" for product "Leap"
*-
Affected
Oracle
Search vendor "Oracle"
 Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel Aus
Search vendor "Redhat" for product "Rhel Aus"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel E4s
Search vendor "Redhat" for product "Rhel E4s"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel Eus
Search vendor "Redhat" for product "Rhel Eus"
*-
Affected
Redhat
Search vendor "Redhat"
 Rhel Tus
Search vendor "Redhat" for product "Rhel Tus"
*-
Affected
Suse
Search vendor "Suse"
 Packagehub
Search vendor "Suse" for product "Packagehub"
*-
Affected
Suse
Search vendor "Suse"
 Sle-module-basesystem
Search vendor "Suse" for product "Sle-module-basesystem"
*-
Affected
Suse
Search vendor "Suse"
 Sle-module-server-applications
Search vendor "Suse" for product "Sle-module-server-applications"
*-
Affected
Suse
Search vendor "Suse"
 Sle Hpc-espos
Search vendor "Suse" for product "Sle Hpc-espos"
*-
Affected
Suse
Search vendor "Suse"
 Sle Hpc-ltss
Search vendor "Suse" for product "Sle Hpc-ltss"
*-
Affected
Suse
Search vendor "Suse"
 Sle Hpc
Search vendor "Suse" for product "Sle Hpc"
*-
Affected
Suse
Search vendor "Suse"
 Sled
Search vendor "Suse" for product "Sled"
*-
Affected
Suse
Search vendor "Suse"
 Sles-ltss
Search vendor "Suse" for product "Sles-ltss"
*-
Affected
Suse
Search vendor "Suse"
 Sles
Search vendor "Suse" for product "Sles"
*-
Affected
Suse
Search vendor "Suse"
 Sles Sap
Search vendor "Suse" for product "Sles Sap"
*-
Affected
Suse
Search vendor "Suse"
 Suse-manager-proxy
Search vendor "Suse" for product "Suse-manager-proxy"
*-
Affected
Suse
Search vendor "Suse"
 Suse-manager-server
Search vendor "Suse" for product "Suse-manager-server"
*-
Affected