Heap buffer overflow in virtio_crypto_sym_op_helper()
CVE-2023-3180

6.5MEDIUM

Key Information:

Vendor: Red Hat
Status: qemu; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 3 August 2023

What is CVE-2023-3180?

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of src_len and dst_len in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.