Vulnerability · Published Sep 13, 2023 · Assigned by redhat
CVE-2023-3255Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
Medium 6.5
In plain English
A medium-severity infinite loop in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.9%top 20.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | qemu-guest-agent | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-img | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-audio-pa | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-block-blkio | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-block-curl | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-block-rbd | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-common | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-core | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-gpu | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-gpu-ccw | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-gpu-pci | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-vga | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-device-usb-host | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-device-usb-redirect | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-docs | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-tools | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-ui-egl-headless | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-kvm-ui-opengl | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| AlmaLinux:9 | qemu-pr-helper | 17:8.2.0-11.el9_4 | ALSA-2024:2135 |
| Debian:12 | qemu | 1:7.2+dfsg-7+deb12u2 | DEBIAN-CVE-2023-3255 |
| Debian:13 | qemu | 1:8.0.4+dfsg-1 | DEBIAN-CVE-2023-3255 |
| Debian:14 | qemu | 1:8.0.4+dfsg-1 | DEBIAN-CVE-2023-3255 |
| Rocky Linux:8 | hivex | 0:1.3.18-23.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | libguestfs | 1:1.44.0-9.module+el8.10.0+1590+a67ab969.rocky | RLSA-2024:2962 |
| Rocky Linux:8 | libguestfs-winsupport | 0:8.10-1.module+el8.10.0+1451+358d0d76 | RLSA-2024:2962 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | libnbd | 0:1.6.0-5.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | libtpms | 0:0.9.1-2.20211126git1ff6fe1f43.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | libvirt | 0:8.0.0-23.1.module+el8.10.0+1779+84732956 | RLSA-2024:2962 |
| Rocky Linux:8 | libvirt-dbus | 0:1.3.0-2.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | libvirt-python | 0:8.0.0-2.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | nbdkit | 0:1.24.0-5.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | perl-Sys-Virt | 0:8.0.0-1.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | qemu-kvm | 5:6.2.0-49.module+el8.10.0+1752+38c6b60a | RLSA-2024:2962 |
| Rocky Linux:9 | qemu-kvm | 7:8.2.0-11.el9_4 | RLSA-2024:2135 |
| Rocky Linux:8 | seabios | 0:1.16.0-4.module+el8.9.0+1408+7b966129 | RLSA-2024:2962 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | supermin | 0:5.2.1-2.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | swtpm | 0:0.7.0-4.20211109gitb79fd91.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Rocky Linux:8 | virt-v2v | 1:1.42.0-22.module+el8.10.0+1590+a67ab969 | RLSA-2024:2962 |
| Ubuntu:22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu6.16 | USN-6567-1 |
| Ubuntu:22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu6.16 | UBUNTU-CVE-2023-3255 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 Advanced Virtualization | see references |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2024:2135 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2962 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-3255 vdb-entry, x_refsource_REDHAT
- RHBZ#2218486 issue-tracking, x_refsource_REDHAT
- https://security.netapp.com/advisory/ntap-20231020-0008/ x_transferred