Skip to content
fr Sign in
6.0 Medium

CVE-2023-4135 A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU

Description

A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

Affected products and versions

Product Affected versions Fixed in
qemu-kvm 8.1 earliest → < 8.1.0 8.1.0
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 8 Advanced Virtualization Versions not published
Red Hat Enterprise Linux 9 Versions not published
Fedora Versions not published
Extra Packages for Enterprise Linux Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of qemu-kvm

The 3 CVEs of qemu-kvm →
CVE-2022-26354 A flaw was found in the vhost-vsock device of QEMU Not rated CVE-2022-26353 A flaw was found in the virtio-net device of QEMU Not rated
Track this CVE