title: Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes
description: A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.
problem types: NULL Pointer Dereference
affected:
{
product: cnv
vendor: n/a
versions:
version: 4.15.0, status: unaffected
}
{
product: kubevirt
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat OpenShift Virtualization 4
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kubevirt
defaultStatus: unaffected
cpes: cpe:/a:redhat:container_native_virtualization:4
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]