CVE-2024-31420

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31420
A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-31420
https://bugzilla.redhat.com/show_bug.cgi?id=2272951
Configurations

No configuration.

History

03 Apr 2024, 17:24

Type Values Removed Values Added
Summary (en) A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio. (en) A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.

03 Apr 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-03 14:15

Updated : 2024-04-03 17:24

NVD link : CVE-2024-31420

Mitre link : CVE-2024-31420

CVE.ORG link : CVE-2024-31420

JSON object : View

Products Affected

No product.

CWE
CWE-476

NULL Pointer Dereference