Ubuntu.comUB:CVE-2023-4135CVE-2023-4135
6.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
16.1%
A heap out-of-bounds memory read flaw was found in the virtual nvme device
in QEMU. The QEMU process does not validate an offset provided by the guest
before computing a host heap pointer, which is used for copying data back
to the guest. Arbitrary heap memory relative to an allocated buffer can be
disclosed.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | introduced in 8.0.0-rc0 by https://gitlab.com/qemu-project/qemu/-/commit/73064edfb864743cde2c08f319609344af02aeb3 |
References
Related
6.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
16.1%