CVE-2023-4135
Medium
Description
A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.
SeverityMedium
CVSS6.0
Exploit probability—
Product
Qemu
PublishedAug 4, 2023
First seenAug 4, 2023
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- qemu qemu8.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qemu qemu | 8.0.0 ≤ v < 8.1.0, 8.1.0 | 8.1.0 |
| fedoraproject fedora | 38 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.