Description
A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cnv | 4.15.0 | — |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | kubevirt.io/kubevirt | <= 1.2.0 | — | GHSA-vjhf-6xfr-5p9g |
| Go | kubevirt.io/kubevirt | all versions | — | GO-2024-2688 |
References
- https://access.redhat.com/security/cve/CVE-2024-31420 vdb-entry
- RHBZ#2272951 issue-tracking