Vulnerability · Published Jan 2, 2024 · Assigned by redhat

CVE-2023-6693Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()

Medium 4.9

In plain English

A medium-severity stack buffer overflow in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	qemu	1:7.2+dfsg-7+deb12u4	DEBIAN-CVE-2023-6693
Debian:13	qemu	1:8.2.0+ds-3	DEBIAN-CVE-2023-6693
Debian:14	qemu	1:8.2.0+ds-3	DEBIAN-CVE-2023-6693
Rocky Linux:8	hivex	0:1.3.18-23.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	libguestfs	1:1.44.0-9.module+el8.10.0+1590+a67ab969.rocky	RLSA-2024:2962
Rocky Linux:8	libguestfs-winsupport	0:8.10-1.module+el8.10.0+1451+358d0d76	RLSA-2024:2962
Rocky Linux:8	libiscsi	0:1.18.0-8.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	libnbd	0:1.6.0-5.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	libtpms	0:0.9.1-2.20211126git1ff6fe1f43.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	libvirt	0:8.0.0-23.1.module+el8.10.0+1779+84732956	RLSA-2024:2962
Rocky Linux:8	libvirt-dbus	0:1.3.0-2.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	libvirt-python	0:8.0.0-2.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	nbdkit	0:1.24.0-5.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	netcf	0:0.2.8-12.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	perl-Sys-Virt	0:8.0.0-1.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	qemu-kvm	5:6.2.0-49.module+el8.10.0+1752+38c6b60a	RLSA-2024:2962
Rocky Linux:9	qemu-kvm	7:9.0.0-10.el9_5.3	RLSA-2025:4492
Rocky Linux:8	seabios	0:1.16.0-4.module+el8.9.0+1408+7b966129	RLSA-2024:2962
Rocky Linux:8	sgabios	1:0.20170427git-3.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	supermin	0:5.2.1-2.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	swtpm	0:0.7.0-4.20211109gitb79fd91.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Rocky Linux:8	virt-v2v	1:1.42.0-22.module+el8.10.0+1590+a67ab969	RLSA-2024:2962
Ubuntu:22.04:LTS	qemu	1:6.2+dfsg-2ubuntu6.22	USN-6954-1
Ubuntu:22.04:LTS	qemu	1:6.2+dfsg-2ubuntu6.22	UBUNTU-CVE-2023-6693

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 8 Advanced Virtualization	see references

Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

RHSA-2024:2962 vendor-advisory, x_refsource_REDHAT
RHSA-2025:4492 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-6693 vdb-entry, x_refsource_REDHAT
RHBZ#2254580 issue-tracking, x_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGUN5HVOXESW7MSNM44E4AE2VNXQB6Y/ x_transferred
https://security.netapp.com/advisory/ntap-20240208-0004/ x_transferred
https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html