Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2023-42467 |
CWE-ID | CWE-369 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
QEMU Client/Desktop applications / Virtualization software |
Vendor | QEMU |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU85828
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-42467
CWE-ID:
CWE-369 - Divide By Zero
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a division by zero error within the scsi_disk_reset() function in hw/scsi/scsi-disk.c. A local user can pass specially crafted data to the application and crash it.
Install update from vendor's website.
Vulnerable software versionsQEMU: All versions
External linkshttp://gitlab.com/qemu-project/qemu/-/issues/1813
http://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c
http://security.netapp.com/advisory/ntap-20231103-0005/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.