CVE-2024-31420
Fixed in a distro release EPSS <1%CVSS 6.5
A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.
Products: Red Hat OpenShift Virtualization 4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | kubevirt.io/kubevirt | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | docker-machine-driver-harvester | 0 |
| Chainguard | harvester | 1.8.1-r1 |
| Chainguard | harvester-fips | 1.8.1-r0 |
| Chainguard | harvester-fips-upgrade-helper | 1.8.1-r0 |
| Chainguard | harvester-fips-webhook | 1.8.1-r0 |
| Chainguard | harvester-upgrade-helper | 1.8.1-r1 |
| Chainguard | harvester-webhook | 1.8.1-r1 |
| Chainguard | virt-api-1.6 | 0 |
| Chainguard | virt-api-1.7 | 0 |
| Chainguard | virt-api-1.8 | 0 |
| Chainguard | virt-api-fips-1.6 | 0 |
| Chainguard | virt-api-fips-1.7 | 0 |
| Chainguard | virt-api-fips-1.8 | 0 |
| Chainguard | virt-chroot-1.6 | 0 |
| Chainguard | virt-chroot-1.7 | 0 |
| Chainguard | virt-chroot-1.8 | 0 |
| Chainguard | virt-chroot-fips-1.6 | 0 |
| Chainguard | virt-chroot-fips-1.7 | 0 |
| Chainguard | virt-chroot-fips-1.8 | 0 |
| Chainguard | virt-controller-1.6 | 0 |
| Chainguard | virt-controller-1.7 | 0 |
| Chainguard | virt-controller-1.8 | 0 |
| Chainguard | virt-controller-fips-1.6 | 1.6.6-r2 |
| Chainguard | virt-controller-fips-1.7 | 0 |
| Chainguard | virt-controller-fips-1.8 | 0 |
| Chainguard | virt-handler-1.6 | 0 |
| Chainguard | virt-handler-1.7 | 0 |
| Chainguard | virt-handler-1.8 | 0 |
| Chainguard | virt-handler-fips-1.6 | 0 |
| Chainguard | virt-handler-fips-1.7 | 0 |
| Chainguard | virt-handler-fips-1.8 | 0 |
| Chainguard | virt-launcher-1.6 | 1.6.6-r3 |
| Chainguard | virt-launcher-1.6-virt-freezer | 1.6.6-r3 |
| Chainguard | virt-launcher-1.6-virt-launcher-monitor | 1.6.6-r3 |
| Chainguard | virt-launcher-1.6-virt-probe | 1.6.6-r3 |
| Chainguard | virt-launcher-1.6-virt-tail | 1.6.6-r3 |
| Chainguard | virt-launcher-1.7 | 1.7.4-r2 |
| Chainguard | virt-launcher-1.7-virt-freezer | 1.7.4-r2 |
| Chainguard | virt-launcher-1.7-virt-launcher-monitor | 1.7.4-r2 |
| Chainguard | virt-launcher-1.7-virt-probe | 1.7.4-r2 |
| Chainguard | virt-launcher-1.7-virt-tail | 1.7.4-r2 |
| Chainguard | virt-launcher-1.8 | 1.8.4-r0 |
| Chainguard | virt-launcher-1.8-libvirt-hook-client | 1.8.4-r0 |
| Chainguard | virt-launcher-1.8-virt-freezer | 1.8.4-r0 |
| Chainguard | virt-launcher-1.8-virt-launcher-monitor | 1.8.4-r0 |
| Chainguard | virt-launcher-1.8-virt-probe | 1.8.4-r0 |
| Chainguard | virt-launcher-1.8-virt-tail | 1.8.4-r0 |
| Chainguard | virt-operator-1.6 | 1.6.6-r1 |
| Chainguard | virt-operator-1.7 | 0 |
| Chainguard | virt-operator-1.8 | 0 |
| Chainguard | virt-operator-fips-1.6 | 1.6.6-r2 |
| Chainguard | virt-operator-fips-1.7 | 0 |
| Chainguard | virt-operator-fips-1.8 | 0 |
| Wolfi | docker-machine-driver-harvester | 0 |