High [CVE-2024-4467] Qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

The impact of this vulnerability in OpenShift Virtualization is downgraded to Low due to the restrictions of the container environment it runs within. As a restricted user within the context of a restricted container, the external files that could be read or written to would already be accessible by an attacker and limited to within the container.

CDI additionally uses memory and CPU limits to prevent uncontrolled resource consumption that could otherwise lead to a denial of service. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-787.

Affected products named by the advisory: Advanced Virtualization for RHEL 8.2.1; Advanced Virtualization for RHEL 8.4.0.EUS; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; and 10 more.