INFSA-2024:4420: virt:rhel and virt-devel:rhel security update

Information about definition

Identificator: INFSA-2024:4420

Type: security

Release date: 2024-10-10 06:04:10 UTC

Information about package

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Vulnerabilities description

  • CVE-2024-4467

    A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
NIST — CVE-2024-4467
 no information 7.8 no information
Critical, important, moderate, low

Updated packages