发布于3月6日3月6日 Members Red Hat: CVE-2024-4467: QEMU: 'qemu-img info' leads to host file read/write (Multiple Advisories) Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 07/02/2024 Created 07/03/2024 Added 07/03/2024 Modified 09/13/2024 Description A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file. Solution(s) redhat-upgrade-hivex redhat-upgrade-hivex-debuginfo redhat-upgrade-hivex-debugsource redhat-upgrade-hivex-devel redhat-upgrade-libguestfs redhat-upgrade-libguestfs-appliance redhat-upgrade-libguestfs-bash-completion redhat-upgrade-libguestfs-debuginfo redhat-upgrade-libguestfs-debugsource redhat-upgrade-libguestfs-devel redhat-upgrade-libguestfs-gfs2 redhat-upgrade-libguestfs-gobject redhat-upgrade-libguestfs-gobject-debuginfo redhat-upgrade-libguestfs-gobject-devel redhat-upgrade-libguestfs-inspect-icons redhat-upgrade-libguestfs-java redhat-upgrade-libguestfs-java-debuginfo redhat-upgrade-libguestfs-java-devel redhat-upgrade-libguestfs-javadoc redhat-upgrade-libguestfs-man-pages-ja redhat-upgrade-libguestfs-man-pages-uk redhat-upgrade-libguestfs-rescue redhat-upgrade-libguestfs-rsync redhat-upgrade-libguestfs-tools redhat-upgrade-libguestfs-tools-c redhat-upgrade-libguestfs-tools-c-debuginfo redhat-upgrade-libguestfs-winsupport redhat-upgrade-libguestfs-xfs redhat-upgrade-libiscsi redhat-upgrade-libiscsi-debuginfo redhat-upgrade-libiscsi-debugsource redhat-upgrade-libiscsi-devel redhat-upgrade-libiscsi-utils redhat-upgrade-libiscsi-utils-debuginfo redhat-upgrade-libnbd redhat-upgrade-libnbd-bash-completion redhat-upgrade-libnbd-debuginfo redhat-upgrade-libnbd-debugsource redhat-upgrade-libnbd-devel redhat-upgrade-libtpms redhat-upgrade-libtpms-debuginfo redhat-upgrade-libtpms-debugsource redhat-upgrade-libtpms-devel redhat-upgrade-libvirt redhat-upgrade-libvirt-client redhat-upgrade-libvirt-client-debuginfo redhat-upgrade-libvirt-daemon redhat-upgrade-libvirt-daemon-config-network redhat-upgrade-libvirt-daemon-config-nwfilter redhat-upgrade-libvirt-daemon-debuginfo redhat-upgrade-libvirt-daemon-driver-interface redhat-upgrade-libvirt-daemon-driver-interface-debuginfo redhat-upgrade-libvirt-daemon-driver-network redhat-upgrade-libvirt-daemon-driver-network-debuginfo redhat-upgrade-libvirt-daemon-driver-nodedev redhat-upgrade-libvirt-daemon-driver-nodedev-debuginfo redhat-upgrade-libvirt-daemon-driver-nwfilter redhat-upgrade-libvirt-daemon-driver-nwfilter-debuginfo redhat-upgrade-libvirt-daemon-driver-qemu redhat-upgrade-libvirt-daemon-driver-qemu-debuginfo redhat-upgrade-libvirt-daemon-driver-secret redhat-upgrade-libvirt-daemon-driver-secret-debuginfo redhat-upgrade-libvirt-daemon-driver-storage redhat-upgrade-libvirt-daemon-driver-storage-core redhat-upgrade-libvirt-daemon-driver-storage-core-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-disk redhat-upgrade-libvirt-daemon-driver-storage-disk-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-gluster redhat-upgrade-libvirt-daemon-driver-storage-gluster-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-iscsi redhat-upgrade-libvirt-daemon-driver-storage-iscsi-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-iscsi-direct redhat-upgrade-libvirt-daemon-driver-storage-iscsi-direct-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-logical redhat-upgrade-libvirt-daemon-driver-storage-logical-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-mpath redhat-upgrade-libvirt-daemon-driver-storage-mpath-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-rbd redhat-upgrade-libvirt-daemon-driver-storage-rbd-debuginfo redhat-upgrade-libvirt-daemon-driver-storage-scsi redhat-upgrade-libvirt-daemon-driver-storage-scsi-debuginfo redhat-upgrade-libvirt-daemon-kvm redhat-upgrade-libvirt-dbus redhat-upgrade-libvirt-dbus-debuginfo redhat-upgrade-libvirt-dbus-debugsource redhat-upgrade-libvirt-debuginfo redhat-upgrade-libvirt-debugsource redhat-upgrade-libvirt-devel redhat-upgrade-libvirt-docs redhat-upgrade-libvirt-libs redhat-upgrade-libvirt-libs-debuginfo redhat-upgrade-libvirt-lock-sanlock redhat-upgrade-libvirt-lock-sanlock-debuginfo redhat-upgrade-libvirt-nss redhat-upgrade-libvirt-nss-debuginfo redhat-upgrade-libvirt-python-debugsource redhat-upgrade-libvirt-wireshark redhat-upgrade-libvirt-wireshark-debuginfo redhat-upgrade-lua-guestfs redhat-upgrade-lua-guestfs-debuginfo redhat-upgrade-nbdfuse redhat-upgrade-nbdfuse-debuginfo redhat-upgrade-nbdkit redhat-upgrade-nbdkit-bash-completion redhat-upgrade-nbdkit-basic-filters redhat-upgrade-nbdkit-basic-filters-debuginfo redhat-upgrade-nbdkit-basic-plugins redhat-upgrade-nbdkit-basic-plugins-debuginfo redhat-upgrade-nbdkit-curl-plugin redhat-upgrade-nbdkit-curl-plugin-debuginfo redhat-upgrade-nbdkit-debuginfo redhat-upgrade-nbdkit-debugsource redhat-upgrade-nbdkit-devel redhat-upgrade-nbdkit-example-plugins redhat-upgrade-nbdkit-example-plugins-debuginfo redhat-upgrade-nbdkit-gzip-filter redhat-upgrade-nbdkit-gzip-filter-debuginfo redhat-upgrade-nbdkit-gzip-plugin redhat-upgrade-nbdkit-gzip-plugin-debuginfo redhat-upgrade-nbdkit-linuxdisk-plugin redhat-upgrade-nbdkit-linuxdisk-plugin-debuginfo redhat-upgrade-nbdkit-nbd-plugin redhat-upgrade-nbdkit-nbd-plugin-debuginfo redhat-upgrade-nbdkit-python-plugin redhat-upgrade-nbdkit-python-plugin-debuginfo redhat-upgrade-nbdkit-server redhat-upgrade-nbdkit-server-debuginfo redhat-upgrade-nbdkit-ssh-plugin redhat-upgrade-nbdkit-ssh-plugin-debuginfo redhat-upgrade-nbdkit-tar-filter redhat-upgrade-nbdkit-tar-filter-debuginfo redhat-upgrade-nbdkit-tar-plugin redhat-upgrade-nbdkit-tar-plugin-debuginfo redhat-upgrade-nbdkit-tmpdisk-plugin redhat-upgrade-nbdkit-tmpdisk-plugin-debuginfo redhat-upgrade-nbdkit-vddk-plugin redhat-upgrade-nbdkit-vddk-plugin-debuginfo redhat-upgrade-nbdkit-xz-filter redhat-upgrade-nbdkit-xz-filter-debuginfo redhat-upgrade-netcf redhat-upgrade-netcf-debuginfo redhat-upgrade-netcf-debugsource redhat-upgrade-netcf-devel redhat-upgrade-netcf-libs redhat-upgrade-netcf-libs-debuginfo redhat-upgrade-ocaml-hivex redhat-upgrade-ocaml-hivex-debuginfo redhat-upgrade-ocaml-hivex-devel redhat-upgrade-ocaml-libguestfs redhat-upgrade-ocaml-libguestfs-debuginfo redhat-upgrade-ocaml-libguestfs-devel redhat-upgrade-ocaml-libnbd redhat-upgrade-ocaml-libnbd-debuginfo redhat-upgrade-ocaml-libnbd-devel redhat-upgrade-perl-hivex redhat-upgrade-perl-hivex-debuginfo redhat-upgrade-perl-sys-guestfs redhat-upgrade-perl-sys-guestfs-debuginfo redhat-upgrade-perl-sys-virt redhat-upgrade-perl-sys-virt-debuginfo redhat-upgrade-perl-sys-virt-debugsource redhat-upgrade-python3-hivex redhat-upgrade-python3-hivex-debuginfo redhat-upgrade-python3-libguestfs redhat-upgrade-python3-libguestfs-debuginfo redhat-upgrade-python3-libnbd redhat-upgrade-python3-libnbd-debuginfo redhat-upgrade-python3-libvirt redhat-upgrade-python3-libvirt-debuginfo redhat-upgrade-qemu-guest-agent redhat-upgrade-qemu-guest-agent-debuginfo redhat-upgrade-qemu-img redhat-upgrade-qemu-img-debuginfo redhat-upgrade-qemu-kvm redhat-upgrade-qemu-kvm-audio-dbus-debuginfo redhat-upgrade-qemu-kvm-audio-pa redhat-upgrade-qemu-kvm-audio-pa-debuginfo redhat-upgrade-qemu-kvm-block-blkio redhat-upgrade-qemu-kvm-block-blkio-debuginfo redhat-upgrade-qemu-kvm-block-curl redhat-upgrade-qemu-kvm-block-curl-debuginfo redhat-upgrade-qemu-kvm-block-gluster redhat-upgrade-qemu-kvm-block-gluster-debuginfo redhat-upgrade-qemu-kvm-block-iscsi redhat-upgrade-qemu-kvm-block-iscsi-debuginfo redhat-upgrade-qemu-kvm-block-rbd redhat-upgrade-qemu-kvm-block-rbd-debuginfo redhat-upgrade-qemu-kvm-block-ssh redhat-upgrade-qemu-kvm-block-ssh-debuginfo redhat-upgrade-qemu-kvm-common redhat-upgrade-qemu-kvm-common-debuginfo redhat-upgrade-qemu-kvm-core redhat-upgrade-qemu-kvm-core-debuginfo redhat-upgrade-qemu-kvm-debuginfo redhat-upgrade-qemu-kvm-debugsource redhat-upgrade-qemu-kvm-device-display-virtio-gpu redhat-upgrade-qemu-kvm-device-display-virtio-gpu-ccw redhat-upgrade-qemu-kvm-device-display-virtio-gpu-ccw-debuginfo redhat-upgrade-qemu-kvm-device-display-virtio-gpu-debuginfo redhat-upgrade-qemu-kvm-device-display-virtio-gpu-pci redhat-upgrade-qemu-kvm-device-display-virtio-gpu-pci-debuginfo redhat-upgrade-qemu-kvm-device-display-virtio-vga redhat-upgrade-qemu-kvm-device-display-virtio-vga-debuginfo redhat-upgrade-qemu-kvm-device-usb-host redhat-upgrade-qemu-kvm-device-usb-host-debuginfo redhat-upgrade-qemu-kvm-device-usb-redirect redhat-upgrade-qemu-kvm-device-usb-redirect-debuginfo redhat-upgrade-qemu-kvm-docs redhat-upgrade-qemu-kvm-hw-usbredir redhat-upgrade-qemu-kvm-hw-usbredir-debuginfo redhat-upgrade-qemu-kvm-tests redhat-upgrade-qemu-kvm-tests-debuginfo redhat-upgrade-qemu-kvm-tools redhat-upgrade-qemu-kvm-tools-debuginfo redhat-upgrade-qemu-kvm-ui-dbus-debuginfo redhat-upgrade-qemu-kvm-ui-egl-headless redhat-upgrade-qemu-kvm-ui-egl-headless-debuginfo redhat-upgrade-qemu-kvm-ui-opengl redhat-upgrade-qemu-kvm-ui-opengl-debuginfo redhat-upgrade-qemu-kvm-ui-spice redhat-upgrade-qemu-kvm-ui-spice-debuginfo redhat-upgrade-qemu-pr-helper redhat-upgrade-qemu-pr-helper-debuginfo redhat-upgrade-ruby-hivex redhat-upgrade-ruby-hivex-debuginfo redhat-upgrade-ruby-libguestfs redhat-upgrade-ruby-libguestfs-debuginfo redhat-upgrade-seabios redhat-upgrade-seabios-bin redhat-upgrade-seavgabios-bin redhat-upgrade-sgabios redhat-upgrade-sgabios-bin redhat-upgrade-slof redhat-upgrade-supermin redhat-upgrade-supermin-debuginfo redhat-upgrade-supermin-debugsource redhat-upgrade-supermin-devel redhat-upgrade-swtpm redhat-upgrade-swtpm-debuginfo redhat-upgrade-swtpm-debugsource redhat-upgrade-swtpm-devel redhat-upgrade-swtpm-libs redhat-upgrade-swtpm-libs-debuginfo redhat-upgrade-swtpm-tools redhat-upgrade-swtpm-tools-debuginfo redhat-upgrade-swtpm-tools-pkcs11 redhat-upgrade-virt-dib redhat-upgrade-virt-dib-debuginfo redhat-upgrade-virt-v2v redhat-upgrade-virt-v2v-bash-completion redhat-upgrade-virt-v2v-debuginfo redhat-upgrade-virt-v2v-debugsource redhat-upgrade-virt-v2v-man-pages-ja redhat-upgrade-virt-v2v-man-pages-uk References CVE-2024-4467 RHSA-2024:4277 RHSA-2024:4278 RHSA-2024:4372 RHSA-2024:4420
