CVE-2024-4467

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

The impact of this vulnerability in OpenShift Virtualization is downgraded to Low due to the restrictions of the container environment it runs within. As a restricted user within the context of a restricted container, the external files that could be read or written to would already be accessible by an attacker and limited to within the container. CDI additionally uses memory and CPU limits to prevent uncontrolled resource consumption that could otherwise lead to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.