{"id":"CVE-2023-1544","aliases":["AZL-25807","AZL-35166","BELL-CVE-2023-1544","DEBIAN-CVE-2023-1544","DLA-4144-1","EUVD-2023-23779","GHSA-8j56-863j-pww9","MGASA-2024-0387","OESA-2023-1875","OESA-2023-1894","OESA-2023-1895","OESA-2023-1896","OESA-2023-1897","SUSE-SU-2024:1103-1","SUSE-SU-2025:4523-1","SUSE-SU-2026:0043-1","SUSE-SU-2026:0070-1","SUSE-SU-2026:2406-1","UBUNTU-CVE-2023-1544","USN-6567-1"],"status":"published","title":"Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00309,"percentile":0.23893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-770"],"published":"2023-03-23T00:00:00Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-23"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"qemu","fixed_in":["9.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["8.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.2.0+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.2.0+ds-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","fixed_in":["4.1.0-81.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","fixed_in":["4.1.0-77.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"qemu","fixed_in":["6.2.0-83.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","fixed_in":["6.2.0-86.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"qemu","fixed_in":["6.2.0-86.oe2203sp2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"qemu","fixed_in":["3.1.1.1-81.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"qemu","fixed_in":["3.1.1.1-81.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"qemu","fixed_in":["1:4.2-3ubuntu6.28"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.16"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"},{"fixed":"9.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"8.2.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u3"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.0+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.0+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-11+deb11u4"}]}],"versions":["1:5.2+dfsg-11","1:5.2+dfsg-11+deb11u1","1:5.2+dfsg-11+deb11u2","1:5.2+dfsg-11+deb11u3"],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-81.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-77.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-83.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-86.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-86.oe2203sp2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-81.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-81.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.138.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-84.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-84.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.28"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26","1:4.2-3ubuntu6.27"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.16"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.28"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26","1:4.2-3ubuntu6.27"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.16"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15"],"bundled":11}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"qemu","product":"qemu"},{"vendor":"qemu","product":"rdma"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-1544","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180364","tags":["x_transferred","Issue Tracking","Mailing List","Patch","Vendor Advisory","report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230511-0005/","tags":["x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1544","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230511-0005"},{"url":"https://github.com/advisories/GHSA-8j56-863j-pww9"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-1544","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-55","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1544.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-1544","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1875","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1894","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1895","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1896","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1897","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241103-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205316","tags":["report"]},{"url":"https://bugzilla.suse.com/1209554","tags":["report"]},{"url":"https://bugzilla.suse.com/1218484","tags":["report"]},{"url":"https://bugzilla.suse.com/1220062","tags":["report"]},{"url":"https://bugzilla.suse.com/1220065","tags":["report"]},{"url":"https://bugzilla.suse.com/1220134","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26328","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254523-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260043-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227397","tags":["report"]},{"url":"https://bugzilla.suse.com/1252768","tags":["report"]},{"url":"https://bugzilla.suse.com/1253002","tags":["report"]},{"url":"https://bugzilla.suse.com/1254286","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260070-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262406-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250984","tags":["report"]},{"url":"https://bugzilla.suse.com/1258509","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2243","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-1544","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6567-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-24165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42467","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-1544","title":"Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T00:00:00Z","modified":"2025-11-03T19:27:58.423Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-23779","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T00:00:00Z","modified":"2025-11-03T19:27:58Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-8j56-863j-pww9","title":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows...","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T21:30:20Z","modified":"2025-11-03T21:31:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125","CWE-770"],"updated_at":"2026-11-02T15:04:19.274788Z"}],"nvd":[{"id":"CVE-2023-1544","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T20:15:14.497Z","modified":"2026-06-17T05:28:13.523Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-770"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"AZL-25807","title":"CVE-2023-1544 affecting package qemu for versions less than 6.2.0-23","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T20:15:14Z","modified":"2026-04-21T04:23:16.530949Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-35166","title":"CVE-2023-1544 affecting package qemu for versions less than 8.2.0-1","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T20:15:14Z","modified":"2026-04-21T04:53:57.216302Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2023-1544","status":"published","published":"2023-10-18T13:45:09.487207Z","modified":"2026-01-26T09:33:07.164269Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-1544","title":"Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T00:00:00Z","modified":"2026-10-28T02:30:53.6849309Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"DEBIAN-CVE-2023-1544","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T20:15:14.497Z","modified":"2026-10-26T18:00:05.883373155Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1875","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.(CVE-2023-1544)","status":"published","published":"2023-12-01T11:06:19Z","modified":"2026-08-18T01:18:04.380904648Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1894","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.(CVE-2023-1544)","status":"published","published":"2023-12-08T11:06:20Z","modified":"2026-08-18T01:18:05.244745539Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1895","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.(CVE-2023-1544)","status":"published","published":"2023-12-08T11:06:20Z","modified":"2026-08-18T01:18:05.308856311Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1896","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.(CVE-2023-1544)","status":"published","published":"2023-12-08T11:06:20Z","modified":"2026-08-18T01:18:05.258505598Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1897","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.(CVE-2023-1544)","status":"published","published":"2023-12-08T11:06:20Z","modified":"2026-08-18T01:18:04.754797857Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"UBUNTU-CVE-2023-1544","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.","status":"published","published":"2023-03-23T20:15:00Z","modified":"2026-06-01T19:00:21.976876802Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"DLA-4144-1","title":"qemu - security update","status":"published","published":"2025-04-30T00:00:00Z","modified":"2026-03-09T01:22:46.208749Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:1103-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-26327: Fixed buffer overflow via invalid SR/IOV NumVFs value (bsc#1220062).\n- CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134).\n- CVE-2023-6693: Fixed stack buffer overflow in virtio_net_flush_tx() (bsc#1218484).\n- CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554).\n- CVE-2024-26328: Fixed invalid NumVFs value handled in NVME SR/IOV implementation (bsc#1220065).\n\nThe following non-security bug was fixed:\n\n- Removing in-use mediated device should fail with error message instead of hang (bsc#1205316).\n","status":"published","published":"2024-04-03T12:11:07Z","modified":"2026-02-04T04:40:44.89986Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2025:4523-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2023-1544: pvrdma: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554)\n","status":"published","published":"2025-12-26T10:45:48Z","modified":"2026-03-23T04:50:26.053124Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0043-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-1544: out-of-bounds read in VMWare's paravirtual RDMA device operations can be exploited through a malicious\n  guest driver to crash the QEMU process on the host (bsc#1209554).\n- CVE-2024-6505: heap-based buffer overflow in the virtio-net device operations can be exploited by a malicious\n  privileged user to crash the QEMU process on the host (bsc#1227397).\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n\nOther updates and bugfixes: \n  \n- [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.\n- [openSUSE][RPM} spec: delete old specfile constructs.\n- block/curl: fix curl internal handles handling (bsc#1252768).\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n","status":"published","published":"2026-01-06T16:03:07Z","modified":"2026-02-04T03:05:12.391355Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0070-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-6505: Fixed queue index out-of-bounds access in software RSS (bsc#1227397)\n- CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554)\n","status":"published","published":"2026-01-08T13:21:59Z","modified":"2026-02-04T02:56:52.231511Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:2406-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2023-1544: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554).\n- CVE-2025-11234: qemu-kvm: use-after-free in websocket handshake code can lead to denial of service (bsc#1250984).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n","status":"published","published":"2026-06-16T06:54:25Z","modified":"2026-06-17T09:15:06.718879709Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"USN-6567-1","title":"qemu vulnerabilities","description":"Gaoning Pan and Xingwei Li discovered that QEMU incorrectly handled the\nUSB xHCI controller device. A privileged guest attacker could possibly use\nthis issue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2020-14394)\n\nIt was discovered that QEMU incorrectly handled the TCG Accelerator. A\nlocal attacker could use this issue to cause QEMU to crash, leading to a\ndenial of service, or possibly execute arbitrary code and esclate\nprivileges. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-24165)\n\nIt was discovered that QEMU incorrectly handled the Intel HD audio device.\nA malicious guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2021-3611)\n\nIt was discovered that QEMU incorrectly handled the ATI VGA device. A\nmalicious guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2021-3638)\n\nIt was discovered that QEMU incorrectly handled the VMWare paravirtual RDMA\ndevice. A malicious guest attacker could use this issue to cause QEMU to\ncrash, leading to a denial of service. (CVE-2023-1544)\n\nIt was discovered that QEMU incorrectly handled the 9p passthrough\nfilesystem. A malicious guest attacker could possibly use this issue to\nopen special files and escape the exported 9p tree. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.\n(CVE-2023-2861)\n\nIt was discovered that QEMU incorrectly handled the virtual crypto device.\nA malicious guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.\n(CVE-2023-3180)\n\nIt was discovered that QEMU incorrectly handled the built-in VNC server.\nA remote authenticated attacker could possibly use this issue to cause QEMU\nto stop responding, resulting in a denial of service. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-3255)\n\nIt was discovered that QEMU incorrectly handled net device hot-unplugging.\nA malicious guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 23.04. (CVE-2023-3301)\n\nIt was discovered that QEMU incorrectly handled the built-in VNC server.\nA remote attacker could possibly use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-3354)\n\nIt was discovered that QEMU incorrectly handled NVME devices. A malicious\nguest attacker could use this issue to cause QEMU to crash, leading to a\ndenial of service. This issue only affected Ubuntu 23.10. (CVE-2023-40360)\n\nIt was discovered that QEMU incorrectly handled NVME devices. A malicious\nguest attacker could use this issue to cause QEMU to crash, leading to a\ndenial of service, or possibly obtain sensitive information. This issue\nonly affected Ubuntu 23.10. (CVE-2023-4135)\n\nIt was discovered that QEMU incorrectly handled SCSI devices. A malicious\nguest attacker could use this issue to cause QEMU to crash, leading to a\ndenial of service. This issue only affected Ubuntu 23.04 and Ubuntu 23.10.\n(CVE-2023-42467)\n\nIt was discovered that QEMU incorrectly handled certain disk offsets. A\nmalicious guest attacker could possibly use this issue to gain control of\nthe host in certain nested virtualization scenarios. (CVE-2023-5088)\n","status":"published","published":"2024-01-08T17:46:08Z","modified":"2026-04-27T17:17:23.282117066Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}