CVE-2024-4467 json
Qemu-kvm: 'qemu-img info' leads to host file read/write
published 2024-07-02 2 y ago modified 2026-11-04 4 d ago also EUVD-2024-44082
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
Patch / fix
- Red Hat Advanced Virtualization for RHEL 8.2.1 8020120240708124623.863bb0db
- Red Hat Advanced Virtualization for RHEL 8.4.0.EUS 8040020240708093550.522a0ee4
- Red Hat Red Hat Enterprise Linux 8 8100020240704072441.489197e6
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020240703100448.522a0ee4
- Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020240703100448.522a0ee4
- Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020240703100448.522a0ee4
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020240703092415.ad008a3a
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020240703092415.ad008a3a
- Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020240703092415.ad008a3a
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240703085245.63b34585
- Red Hat Red Hat Enterprise Linux 9 17:8.2.0-11.el9_4.4
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 17:6.2.0-11.el9_0.9
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 17:7.2.0-14.el9_2.11
- qemu Debian 12 1:7.2+dfsg-7+deb12u7
- qemu Debian 14, Debian 13 1:9.0.1+ds-1
debian advisories DEBIAN-CVE-2024-4467
- qemu Ubuntu 22.04 LTS 1:6.2+dfsg-2ubuntu6.27
- qemu Ubuntu 24.04 LTS 1:8.2.2+ds-0ubuntu1.10
- qemu Ubuntu Pro 20.04 LTS 1:4.2-3ubuntu6.30+esm1
ubuntu advisories UBUNTU-CVE-2024-4467
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- SLOF advanced virtualization 8.2 20191022-3.git899d9883.module+el8.2.0+5449+efc036dd
- hivex advanced virtualization 8.2 1.3.18-20.module+el8.2.0+5588+63a201c3
- netcf advanced virtualization 8.2 0.2.8-12.module+el8.2.0+4793+b09dd2fb
- swtpm advanced virtualization 8.2 0.2.0-2.20200127gitff5a83b.module+el8.2.0+5579+d71178e0
- libnbd advanced virtualization 8.2 1.2.2-1.module+el8.2.0+5644+32ac38d4
- nbdkit advanced virtualization 8.2 1.16.2-4.module+el8.2.1+6710+effcb1df
- libtpms advanced virtualization 8.2 0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb
- libvirt advanced virtualization 8.2 6.0.0-25.6.module+el8.2.1+12457+868e9540
red hat advisories RHSA-2024:4374RHSA-2024:4373RHSA-2024:4727RHSA-2024:4372RHSA-2024:4420RHSA-2024:4724
- qemu Linux Micro 6.0 8.2.6-1.1
- qemu SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +5 more 6.2.0-150400.37.34.1
- qemu SLE Module for Server Applications 15 SP5, SLE Module for Package Hub 15 SP5, SLE Module for Basesystem 15 SP5 +3 more 7.1.0-150500.49.18.1
- qemu SLE Module for Server Applications 15 SP6, SLE Module for Package Hub 15 SP6, SLE Module for Basesystem 15 SP6 +1 more 8.2.6-150600.3.9.1
- qemu-linux-user SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 8.2.6-150600.3.9.1
- qemu SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 5.2.0-150300.130.1
suse advisories SUSE-SU-2025:20036-1SUSE-SU-2024:3396-1SUSE-SU-2024:3077-1SUSE-SU-2024:2983-1SUSE-SU-2024:2977-1
- qemu openSUSE Tumbleweed 9.1.0-2.1
opensuse advisories openSUSE-SU-2024:14411-1
- SLOF AlmaLinux 8 20210217-2.module_el8.10.0+3768+dfd76e10
- hivex AlmaLinux 8 1.3.18-23.module_el8.6.0+2880+7d9e3703
- hivex AlmaLinux 8 1.3.18-23.module_el8.6.0+3161+a07c0ea5
- netcf AlmaLinux 8 0.2.8-12.module_el8.6.0+2880+7d9e3703
- netcf AlmaLinux 8 0.2.8-12.module_el8.6.0+3161+a07c0ea5
- swtpm AlmaLinux 8 0.7.0-4.20211109gitb79fd91.module_el8.7.0+3346+68867adb
- libnbd AlmaLinux 8 1.6.0-5.module_el8.6.0+2880+7d9e3703
- libnbd AlmaLinux 8 1.6.0-5.module_el8.6.0+3161+a07c0ea5
almalinux advisories ALSA-2024:4420ALSA-2024:4278
- hivex Rocky Linux 8 1.3.18-23.module+el8.10.0+1590+a67ab969
- hivex Rocky Linux 8 1.3.18-23.module+el8.10.0+1835+43f01cbb
- netcf Rocky Linux 8 0.2.8-12.module+el8.10.0+1590+a67ab969
- netcf Rocky Linux 8 0.2.8-12.module+el8.10.0+1835+43f01cbb
- swtpm Rocky Linux 8 0.7.0-4.20211109gitb79fd91.module+el8.10.0+1590+a67ab969
- swtpm Rocky Linux 8 0.7.0-4.20211109gitb79fd91.module+el8.10.0+1835+43f01cbb
- libnbd Rocky Linux 8 1.6.0-5.module+el8.10.0+1590+a67ab969
- libnbd Rocky Linux 8 1.6.0-5.module+el8.10.0+1835+43f01cbb
rocky linux advisories RLSA-2024:4420
- qemu CBL-Mariner 2.0 6.2.0-24
- qemu Azure Linux 3.0 8.2.0-16
azure linux advisories AZL-60091AZL-60922
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-4467 updated cvss 7.8
qemu-kvm: 'qemu-img info' leads to host file read/write
-
Red Hat Enterprise Linux 8 Advanced Virtualization qemu-img, qemu-kvm, qemu-kiwi, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, +9 moreaffected: no fix available
-
Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-cdi-operator-rhel9affected: no fix available “Fix deferred”
-
Red Hat Advanced Virtualization for RHEL 8.2.1 libnbd 1.2.2-1.module+el8.2.0+5644+32ac38d4, netcf 0.2.8-12.module+el8.2.0+4793+b09dd2fb, hivex 1.3.18-20.module+el8.2.0+5588+63a201c3, nbdfuse 1.2.2-1.module+el8.2.0+5644+32ac38d4, nbdkit 1.16.2-4.module+el8.2.1+6710+effcb1df, seabios 1.13.0-2.module+el8.2.1+7284+aa32a2c4, +96 morefixed: vendor fix RHSA-2024:4727
-
Red Hat Advanced Virtualization for RHEL 8.4.0.EUS netcf 0.2.8-12.module+el8.4.0+8855+a9e237a9, libnbd 1.6.0-5.module+el8.4.0+14155+dec4a5c7, nbdkit 1.24.0-1.module+el8.4.0+9341+96cf2672, hivex 1.3.18-21.module+el8.4.0+11609+2eba841a, nbdfuse 1.6.0-5.module+el8.4.0+14155+dec4a5c7, seabios 1.14.0-1.module+el8.4.0+8855+a9e237a9, +110 morefixed: vendor fix RHSA-2024:4724
-
Red Hat CodeReady Linux Builder EUS (v.8.8) libnbd 1.6.0-5.module+el8.8.0+16781+9f4724c2, netcf 0.2.8-12.module+el8.8.0+16781+9f4724c2, hivex 1.3.18-23.module+el8.8.0+16781+9f4724c2, nbdfuse 1.6.0-5.module+el8.8.0+16781+9f4724c2, SLOF 20210217-2.module+el8.8.0+20737+daad9f3b, seabios 1.16.0-4.module+el8.8.0+19627+2d14cb21, +38 morefixed: vendor fix RHSA-2024:4372
-
Red Hat Enterprise Linux AppStream (v. 8) libnbd 1.6.0-5.module+el8.9.0+18724+20190c23, netcf 0.2.8-12.module+el8.9.0+18724+20190c23, hivex 1.3.18-23.module+el8.9.0+18724+20190c23, nbdfuse 1.6.0-5.module+el8.9.0+18724+20190c23, nbdkit 1.24.0-5.module+el8.9.0+18724+20190c23, seabios 1.16.0-4.module+el8.9.0+19570+14a90618, +104 morefixed: vendor fix RHSA-2024:4420
-
Red Hat Enterprise Linux AppStream (v. 9) qemu-img 8.2.0-11.el9_4.4, qemu-kvm 8.2.0-11.el9_4.4, qemu-kvm-core 8.2.0-11.el9_4.4, qemu-kvm-tools 8.2.0-11.el9_4.4, qemu-pr-helper 8.2.0-11.el9_4.4, qemu-kvm-common 8.2.0-11.el9_4.4, +13 morefixed: vendor fix RHSA-2024:4278
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) libnbd 1.2.2-1.module+el8.3.0+7353+9de0a3cc, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, nbdfuse 1.2.2-1.module+el8.3.0+7353+9de0a3cc, nbdkit 1.16.2-4.module+el8.3.0+6922+fd575af8, hivex 1.3.18-21.module+el8.4.0+10770+19c037f9, seabios 1.13.0-2.module+el8.3.0+7353+9de0a3cc, +87 morefixed: vendor fix RHSA-2024:4374
show 10 moreshow fewer
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) libnbd 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, netcf 0.2.8-12.module+el8.6.0+14480+c0a3aa0f, hivex 1.3.18-23.module+el8.6.0+14480+c0a3aa0f, nbdfuse 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, nbdkit 1.24.0-4.module+el8.6.0+14480+c0a3aa0f, supermin 5.2.1-1.module+el8.6.0+14480+c0a3aa0f, +103 morefixed: vendor fix RHSA-2024:4373
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) libnbd 1.2.2-1.module+el8.3.0+7353+9de0a3cc, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, nbdfuse 1.2.2-1.module+el8.3.0+7353+9de0a3cc, nbdkit 1.16.2-4.module+el8.3.0+6922+fd575af8, hivex 1.3.18-21.module+el8.4.0+10770+19c037f9, seabios 1.13.0-2.module+el8.3.0+7353+9de0a3cc, +88 morefixed: vendor fix RHSA-2024:4374
-
Red Hat Enterprise Linux AppStream E4S (v.8.6) libnbd 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, netcf 0.2.8-12.module+el8.6.0+14480+c0a3aa0f, hivex 1.3.18-23.module+el8.6.0+14480+c0a3aa0f, nbdfuse 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, nbdkit 1.24.0-4.module+el8.6.0+14480+c0a3aa0f, SLOF 20210217-1.module+el8.6.0+14480+c0a3aa0f, +104 morefixed: vendor fix RHSA-2024:4373
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) qemu-img 6.2.0-11.el9_0.9, qemu-kvm 6.2.0-11.el9_0.9, qemu-kvm-core 6.2.0-11.el9_0.9, qemu-kvm-tools 6.2.0-11.el9_0.9, qemu-pr-helper 6.2.0-11.el9_0.9, qemu-kvm-common 6.2.0-11.el9_0.9, +15 morefixed: vendor fix RHSA-2024:4276
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) libnbd 1.6.0-5.module+el8.8.0+16781+9f4724c2, netcf 0.2.8-12.module+el8.8.0+16781+9f4724c2, hivex 1.3.18-23.module+el8.8.0+16781+9f4724c2, nbdfuse 1.6.0-5.module+el8.8.0+16781+9f4724c2, nbdkit 1.24.0-5.module+el8.8.0+17308+05924798, SLOF 20210217-2.module+el8.8.0+20737+daad9f3b, +104 morefixed: vendor fix RHSA-2024:4372
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) qemu-img 7.2.0-14.el9_2.11, qemu-kvm 7.2.0-14.el9_2.11, qemu-kvm-core 7.2.0-14.el9_2.11, qemu-kvm-tools 7.2.0-14.el9_2.11, qemu-pr-helper 7.2.0-14.el9_2.11, qemu-kvm-common 7.2.0-14.el9_2.11, +12 morefixed: vendor fix RHSA-2024:4277
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) libnbd 1.2.2-1.module+el8.3.0+7353+9de0a3cc, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, nbdfuse 1.2.2-1.module+el8.3.0+7353+9de0a3cc, nbdkit 1.16.2-4.module+el8.3.0+6922+fd575af8, hivex 1.3.18-21.module+el8.4.0+10770+19c037f9, seabios 1.13.0-2.module+el8.3.0+7353+9de0a3cc, +87 morefixed: vendor fix RHSA-2024:4374
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) libnbd 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, netcf 0.2.8-12.module+el8.6.0+14480+c0a3aa0f, hivex 1.3.18-23.module+el8.6.0+14480+c0a3aa0f, nbdfuse 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, nbdkit 1.24.0-4.module+el8.6.0+14480+c0a3aa0f, supermin 5.2.1-1.module+el8.6.0+14480+c0a3aa0f, +103 morefixed: vendor fix RHSA-2024:4373
-
Red Hat Enterprise Linux CRB (v. 8) libnbd 1.6.0-5.module+el8.9.0+18724+20190c23, netcf 0.2.8-12.module+el8.9.0+18724+20190c23, hivex 1.3.18-23.module+el8.9.0+18724+20190c23, nbdfuse 1.6.0-5.module+el8.9.0+18724+20190c23, seabios 1.16.0-4.module+el8.9.0+19570+14a90618, SLOF 20210217-2.module+el8.10.0+20141+6faa2812, +38 morefixed: vendor fix RHSA-2024:4420
-
Red Hat Enterprise Linux 6 qemu-img, qemu-kvm, qemu-kvm-tools, qemu-guest-agent, qemu-guest-agent-win32 Red Hat Enterprise Linux 7 qemu-img, qemu-kvm, libcacard, qemu-img-ma, qemu-kvm-ma, qemu-kvm-tools, +5 more Red Hat Enterprise Linux 10 qemu-kvmnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Red Hat Advanced Virtualization for RHEL 8.2.1
- Red Hat Advanced Virtualization for RHEL 8.4.0.EUS
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8 Advanced Virtualization
- Red Hat Red Hat OpenShift Virtualization 4
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
access.redhat.com
/errata/RHSA-2024:4276
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4277
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4278
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4372
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4373
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4374
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4420
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4724
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4727
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2024-4467
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2278875
issue-tracking
- openwall.com /lists/oss-security/2024/07/23/2
- security.netapp.com /advisory/ntap-20240822-0005/
Sources
- CVE List CVE-2024-4467
- NVD CVE-2024-4467
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.