CVE-2023-4135
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A heap out-of-bounds memory read flaw was found in the virtual NVMe device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which can lead to the disclosure of arbitrary heap memory relative to an allocated buffer.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive data in memory, posing a risk to the security of the system and user data. Organizations should be aware of the potential consequences associated with the exploitation of this vulnerability.
Recommendation
It is recommended to update QEMU to the latest version that includes security patches addressing this vulnerability. Additionally, it is advisable to monitor and restrict access to virtual NVMe devices in the production environment.
Original NVD description (English source)
A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.