Vulnerability · Published Apr 3, 2024 · Assigned by redhat
CVE-2024-31419Cnv: information disclosure through the usage of vm-dump-metrics
Medium 4.3
In plain English
A medium-severity security flaw in cnv. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cnv | 4.15.1 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | see references |
Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2024-31419 vdb-entry, x_refsource_REDHAT
- RHBZ#2272948 issue-tracking, x_refsource_REDHAT