CVE-2023-4135
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A heap out-of-bounds memory read flaw was found in the virtual NVMe device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which can lead to the disclosure of arbitrary heap memory relative to an allocated buffer.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive data in memory, posing a risk to the security of the system and user data. Organizations should be aware of the potential consequences associated with the exploitation of this vulnerability.
Recommendation
It is recommended to update QEMU to the latest version that includes security patches addressing this vulnerability. Additionally, it is advisable to monitor and restrict access to virtual NVMe devices in the production environment.
Other vulnerabilities in QEMU
See all- CVE-2026-93834High
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
- CVE-2015-7504High
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
- CVE-2017-15268High
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
- CVE-2017-13711High
A use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU allows attackers to cause a denial of service (QEMU instance crash) by failing to properly clear ifq_so from pending packets.
- CVE-2014-0145High
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver or various parameters in the DMG block driver.
- CVE-2014-0143High
Multiple integer overflows in QEMU, before version 2.0.0, allow local users to cause a denial of service (crash) by providing crafted input, leading to buffer overflows and memory corruption.
- CVE-2017-10664High
qemu-nbd in QEMU does not ignore SIGPIPE, allowing remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
- CVE-2017-8309High
A memory leak in audio/audio.c in QEMU allows remote attackers to cause a denial of service by repeatedly starting and stopping audio capture.
- CVE-2017-8284High
The disas_insn function in QEMU before version 2.9.0 does not limit instruction size in TCG mode without hardware acceleration, allowing local users to gain privileges by creating a modified basic block that injects code into a setuid program.
- CVE-2015-8619High
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service through out-of-bounds write and application crash.
Original NVD description (English source)
A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS