CVE-2024-4467: QEMU Disk Image Utility DoS Vulnerability

CVE-2024-4467 Overview

A resource exhaustion and arbitrary file access vulnerability has been identified in the QEMU disk image utility (qemu-img) within the info command functionality. The flaw exists in how the utility processes specially crafted image files containing malicious json:{} values that describe block devices using the QEMU Machine Protocol (QMP). When a user runs qemu-img info on a malicious image file, the process can be manipulated to consume excessive memory or CPU resources, resulting in denial of service conditions. More critically, the vulnerability can also be exploited to perform unauthorized read/write operations to existing external files on the host system.

Critical Impact

Attackers with local access can craft malicious disk images that, when processed by qemu-img, lead to denial of service through resource exhaustion or enable unauthorized read/write access to files on the host system.

Affected Products

• QEMU (qemu-img utility)
• Red Hat Enterprise Linux virtualization components
• Systems running QEMU-based virtualization with qemu-img utility

Discovery Timeline

• July 2, 2024 - CVE-2024-4467 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-4467

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and enables both denial of service and potential file system access attacks. The flaw resides in the qemu-img info command's handling of disk image metadata, specifically when processing JSON-formatted block device descriptions.

The vulnerability arises from insufficient validation of json:{} pseudo-protocol values embedded within disk image files. QEMU's block layer supports various protocols for accessing disk images, and the JSON pseudo-protocol allows for complex, nested block device configurations. When qemu-img info parses these configurations, it fails to properly limit resource consumption or restrict file access scope.

An attacker with the ability to create or supply a malicious disk image can embed specially crafted JSON block device specifications. Upon processing, the qemu-img utility may enter states where it allocates unbounded memory, performs excessive CPU operations, or follows file references that grant access to arbitrary files on the host filesystem.

Root Cause

The root cause lies in improper input validation within QEMU's block device configuration parser. When the qemu-img info command encounters a disk image containing json:{} protocol specifications, it recursively processes the embedded configuration without adequate bounds checking. This allows attackers to specify:

1. Deeply nested or circular JSON structures that exhaust memory or CPU during parsing
2. Block device references pointing to existing files outside the intended scope
3. Configuration parameters that trigger excessive resource allocation

The parser fails to implement proper limits on recursion depth, reference resolution, and resource allocation, creating multiple exploitation paths.

Attack Vector

The attack requires local access to the target system. The exploitation scenario involves:

1. An attacker crafts a malicious disk image file containing embedded json:{} block device specifications
2. The malicious image is placed on a system where qemu-img is available
3. When a user or automated process runs qemu-img info on the malicious image, the vulnerability is triggered
4. Depending on the payload, the result is either:
   
   • Resource exhaustion causing denial of service
   • Unauthorized read/write access to files specified in the malicious JSON configuration

The vulnerability is particularly concerning in environments where untrusted disk images may be processed, such as cloud platforms, virtualization infrastructure, or development environments where users may inspect disk images from various sources.

Detection Methods for CVE-2024-4467

Indicators of Compromise

• Unexpected high memory consumption by qemu-img processes
• Abnormal CPU utilization spikes during disk image inspection operations
• Unusual file access patterns from qemu-img processes to sensitive system files
• Presence of disk image files with embedded json:{} protocol specifications targeting external files

Detection Strategies

• Monitor qemu-img process resource consumption for anomalous memory or CPU usage patterns
• Implement file integrity monitoring on sensitive system files to detect unauthorized access from QEMU processes
• Log and audit all qemu-img info command executions, particularly on untrusted or user-supplied disk images
• Deploy endpoint detection rules that alert on qemu-img processes accessing files outside normal virtualization directories

Monitoring Recommendations

• Configure process monitoring to alert when qemu-img exceeds normal resource thresholds
• Enable comprehensive logging for file access operations by virtualization utilities
• Review and audit disk images before processing in production environments
• Implement sandboxing or containerization for disk image inspection operations

How to Mitigate CVE-2024-4467

Immediate Actions Required

• Update QEMU and related packages to the latest patched versions from your distribution
• Restrict execution of qemu-img to trusted administrators only
• Avoid running qemu-img info on untrusted or unverified disk images
• Implement resource limits (cgroups, ulimits) on processes that handle disk images

Patch Information

Multiple security advisories have been released to address this vulnerability. Red Hat has published several security advisories including RHSA-2024:4276, RHSA-2024:4277, RHSA-2024:4278, RHSA-2024:4372, RHSA-2024:4373, RHSA-2024:4374, RHSA-2024:4420, RHSA-2024:4724, and RHSA-2024:4727. NetApp has also issued NTAP-20240822-0005. Organizations should apply these patches immediately following their change management procedures. Additional technical details are available via the Red Hat CVE Analysis and Red Hat Bug Report #2278875.

Workarounds

• Run qemu-img within containers or sandboxed environments with restricted filesystem access
• Implement mandatory access control (SELinux, AppArmor) policies that limit qemu-img file access scope
• Use cgroups to impose strict memory and CPU limits on qemu-img processes
• Validate disk images with trusted tools before processing with qemu-img info

# Example: Restrict qemu-img with cgroups and resource limits
# Create a cgroup with memory and CPU limits
sudo cgcreate -g memory,cpu:qemu-img-restricted
sudo cgset -r memory.limit_in_bytes=512M qemu-img-restricted
sudo cgset -r cpu.cfs_quota_us=50000 qemu-img-restricted

# Run qemu-img within the restricted cgroup
sudo cgexec -g memory,cpu:qemu-img-restricted qemu-img info /path/to/image.qcow2