Qemu-kvm: 'qemu-img info' leads to host file read/write

Summary

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

Timeline

1. Jul 2, 2024, 3:57 PM UTCCVE published
2. Jul 2, 2024, 6:05 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 25, 2026, 8:31 PM UTCRecord last updated

Affected versions

• qemu

  From 4.0.0 · fixed in 9.1.0

• virt:8.2

  Version range not reported

• virt:av

  Version range not reported

• virt-devel:av

  Version range not reported

• virt-devel:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt-devel:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm-ma

  Version range not reported

• virt:av/qemu-kvm

  Version range not reported

• container-native-virtualization/virt-cdi-operator-rhel9

  Version range not reported

References 11