CVE-2023-3354
High
Description
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Qemu
PublishedJul 11, 2023
First seenJul 11, 2023
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- qemu qemu8.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qemu qemu | v < 8.1.0, 8.1.0 | 8.1.0 |
| redhat openstack_platform | 13.0 | — |
| redhat enterprise_linux | 7.0, 8.0, 9.0 | — |
| fedoraproject fedora | 38 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.