Resource Exhaustion Affecting qemu-chardev-baum package, versions <6.2.0-150400.37.34.1


Severity

Recommended
0.0
high
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Resource Exhaustion vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES154-QEMUCHARDEVBAUM-8073181
  • published24 Sept 2024
  • disclosed23 Sept 2024

Introduced: 23 Sep 2024

CVE-2024-4467  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade SLES:15.4 qemu-chardev-baum to version 6.2.0-150400.37.34.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu-chardev-baum package and not the qemu-chardev-baum package as distributed by SLES. See How to fix? for SLES:15.4 relevant fixed versions and status.

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

CVSS Scores

version 3.1