Null Pointer Dereference Vulnerability in QEMU Affected Product
CVE-2023-40360

5.5MEDIUM

Key Information:

Vendor

Qemu
Status
Qemu
Vendor
CVE Published:
14 August 2023

What is CVE-2023-40360?

A vulnerability within QEMU versions up to 8.0.4 allows for a NULL pointer access in the function nvme_directive_receive found in hw/nvme/ctrl.c. The issue arises due to a lack of a check for an endurance group configuration before evaluating whether Flexible Data Placement is enabled. This flaw can lead to unintended behavior or system instability, highlighting the need for proper validation checks within the codebase.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://gitlab.com/qemu-project/qemu/-/issues/1815
https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b23...
https://www.qemu.org/docs/master/system/security.html

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.