Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service

CVE-2023-3354

Summary

A vulnerability has been identified within the built-in VNC server of QEMU, where improper handling of client connections can lead to a NULL pointer dereference. When multiple clients connect to the VNC server, QEMU attempts to manage the number of connections by cleaning up previous connections. If a previous connection is in the handshake phase and subsequently fails, QEMU may attempt to clean up this connection again, resulting in this security flaw. This may allow a remote unauthenticated attacker to exploit this issue and trigger a denial of service.

References