CVE-2024-4467: QEMU Disk Image Utility DoS Vulnerability

CVE-2024-4467 Overview

A resource exhaustion and arbitrary file access vulnerability has been identified in the QEMU disk image utility (qemu-img) within the info command functionality. The flaw exists in how the utility processes specially crafted image files containing malicious json:{} values that describe block devices using the QEMU Machine Protocol (QMP). When a user runs qemu-img info on a malicious image file, the process can be manipulated to consume excessive memory or CPU resources, resulting in denial of service conditions. More critically, the vulnerability can also be exploited to perform unauthorized read/write operations to existing external files on the host system.

Critical Impact
Attackers with local access can craft malicious disk images that, when processed by qemu-img, lead to denial of service through resource exhaustion or enable unauthorized read/write access to files on the host system.

Affected Products

QEMU (qemu-img utility)
Red Hat Enterprise Linux virtualization components
Systems running QEMU-based virtualization with qemu-img utility

Discovery Timeline

July 2, 2024 - CVE-2024-4467 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-4467

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and enables both denial of service and potential file system access attacks. The flaw resides in the qemu-img info command's handling of disk image metadata, specifically when processing JSON-formatted block device descriptions.

The vulnerability arises from insufficient validation of json:{} pseudo-protocol values embedded within disk image files. QEMU's block layer supports various protocols for accessing disk images, and the JSON pseudo-protocol allows for complex, nested block device configurations. When qemu-img info parses these configurations, it fails to properly limit resource consumption or restrict file access scope.

An attacker with the ability to create or supply a malicious disk image can embed specially crafted JSON block device specifications. Upon processing, the qemu-img utility may enter states where it allocates unbounded memory, performs excessive CPU operations, or follows file references that grant access to arbitrary files on the host filesystem.

Root Cause

The root cause lies in improper input validation within QEMU's block device configuration parser. When the qemu-img info command encounters a disk image containing json:{} protocol specifications, it recursively processes the embedded configuration without adequate bounds checking. This allows attackers to specify:

Deeply nested or circular JSON structures that exhaust memory or CPU during parsing
Block device references pointing to existing files outside the intended scope
Configuration parameters that trigger excessive resource allocation

The parser fails to implement proper limits on recursion depth, reference resolution, and resource allocation, creating multiple exploitation paths.

Attack Vector

The attack requires local access to the target system. The exploitation scenario involves:

An attacker crafts a malicious disk image file containing embedded json:{} block device specifications
The malicious image is placed on a system where qemu-img is available
When a user or automated process runs qemu-img info on the malicious image, the vulnerability is triggered
Depending on the payload, the result is either:
- Resource exhaustion causing denial of service
- Unauthorized read/write access to files specified in the malicious JSON configuration

The vulnerability is particularly concerning in environments where untrusted disk images may be processed, such as cloud platforms, virtualization infrastructure, or development environments where users may inspect disk images from various sources.

Detection Methods for CVE-2024-4467

Indicators of Compromise

Unexpected high memory consumption by qemu-img processes
Abnormal CPU utilization spikes during disk image inspection operations
Unusual file access patterns from qemu-img processes to sensitive system files
Presence of disk image files with embedded json:{} protocol specifications targeting external files

Detection Strategies

Monitor qemu-img process resource consumption for anomalous memory or CPU usage patterns
Implement file integrity monitoring on sensitive system files to detect unauthorized access from QEMU processes
Log and audit all qemu-img info command executions, particularly on untrusted or user-supplied disk images
Deploy endpoint detection rules that alert on qemu-img processes accessing files outside normal virtualization directories

Monitoring Recommendations

Configure process monitoring to alert when qemu-img exceeds normal resource thresholds
Enable comprehensive logging for file access operations by virtualization utilities
Review and audit disk images before processing in production environments
Implement sandboxing or containerization for disk image inspection operations

How to Mitigate CVE-2024-4467

Immediate Actions Required

Update QEMU and related packages to the latest patched versions from your distribution
Restrict execution of qemu-img to trusted administrators only
Avoid running qemu-img info on untrusted or unverified disk images
Implement resource limits (cgroups, ulimits) on processes that handle disk images

Patch Information

Multiple security advisories have been released to address this vulnerability. Red Hat has published several security advisories including RHSA-2024:4276, RHSA-2024:4277, RHSA-2024:4278, RHSA-2024:4372, RHSA-2024:4373, RHSA-2024:4374, RHSA-2024:4420, RHSA-2024:4724, and RHSA-2024:4727. NetApp has also issued NTAP-20240822-0005. Organizations should apply these patches immediately following their change management procedures. Additional technical details are available via the Red Hat CVE Analysis and Red Hat Bug Report #2278875.

Workarounds

Run qemu-img within containers or sandboxed environments with restricted filesystem access
Implement mandatory access control (SELinux, AppArmor) policies that limit qemu-img file access scope
Use cgroups to impose strict memory and CPU limits on qemu-img processes
Validate disk images with trusted tools before processing with qemu-img info

bash

# Example: Restrict qemu-img with cgroups and resource limits
# Create a cgroup with memory and CPU limits
sudo cgcreate -g memory,cpu:qemu-img-restricted
sudo cgset -r memory.limit_in_bytes=512M qemu-img-restricted
sudo cgset -r cpu.cfs_quota_us=50000 qemu-img-restricted

# Run qemu-img within the restricted cgroup
sudo cgexec -g memory,cpu:qemu-img-restricted qemu-img info /path/to/image.qcow2