pvedaemon denial-of-service via QEMU guest agent file-read command
Affected packages
qemu-server
Details
Insufficient hardening of the QEMU guest agent file-read handling allowed a malicious guest agent implementation in a VM to cause pvedaemon to allocate additional memory until it triggers an out-of-memory kill action by the kernel.
This issue was privately reported by Martin Vlach <[email protected]> / <[email protected]>.
Fixed in
- qemu-server >= 9.2.11
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.