7.5
High
CVE-2023-3354 A flaw was found in the QEMU built-in VNC server
Description
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| QEMU | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 8 Advanced Virtualization | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenStack Platform 13 (Queens) | Versions not published | |
| Fedora | Versions not published | |
| Extra Packages for Enterprise Linux | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2216478 bugzilla.redhat.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.debian.org lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of QEMU
The 60 CVEs of QEMU →
CVE-2023-2680
This CVE exists because of an incomplete fix for CVE-2021-3750
7.5
High
CVE-2023-3301
A flaw was found in QEMU
5.6
Medium
CVE-2023-3180
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in…
6.0
Medium
CVE-2023-1386
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU
3.3
Low