CVE-2023-3180
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests. There is no check for the value of `src_len` and `dst_len`, potentially leading to a heap buffer overflow when the two values differ.
Risk Assessment
The organization may be exposed to attacks exploiting the buffer overflow, potentially leading to unauthorized memory access or execution of malicious code.
Recommendation
It is recommended to update QEMU to the latest version that includes fixes for this vulnerability and to implement additional safeguards against buffer overflows.
Original NVD description (English source)
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.