CVE Catalog
CVE-2023-40360
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0.39%
31th percentile - higher than 31% of all known CVEs
Summary
QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.
Risk Assessment
The lack of proper checks may lead to application crashes or unexpected behavior, posing a risk to system stability.
Recommendation
It is recommended to update QEMU to version 8.0.5 or later to mitigate this vulnerability.
Original NVD description (English source)
QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.