Improper synchronization in QEMU - CVE-2023-5088

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU85827

Improper synchronization in QEMU - CVE-2023-5088

Published: January 26, 2024


Vulnerability identifier: #VU85827
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-5088
CWE-ID: CWE-662
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper synchronization, which causes guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead. An L2 guest with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor can read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.


Affected software

QEMU
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Ubuntu
Juniper Junos Space
netcf
netcf-devel
netcf-libs
swtpm-tools-pkcs11
swtpm-tools
swtpm-libs
swtpm-devel
swtpm
libtpms-devel
libtpms
sgabios-bin
sgabios
libvirt-dbus
ruby-hivex
hivex-devel
python3-hivex
perl-hivex
hivex
ocaml-hivex-devel
ocaml-hivex
libnbd-devel
nbdfuse
ocaml-libnbd
ocaml-libnbd-devel
libnbd
libnbd-bash-completion
python3-libnbd
seabios-bin
seabios
seavgabios-bin
libiscsi-devel
libiscsi
libiscsi-utils
nbdkit-bash-completion
nbdkit-tar-filter
nbdkit-xz-filter
nbdkit-vddk-plugin
nbdkit
nbdkit-basic-filters
nbdkit-tmpdisk-plugin
nbdkit-basic-plugins
nbdkit-curl-plugin
nbdkit-devel
nbdkit-example-plugins
nbdkit-gzip-filter
nbdkit-gzip-plugin
nbdkit-linuxdisk-plugin
nbdkit-nbd-plugin
nbdkit-python-plugin
nbdkit-server
nbdkit-ssh-plugin
nbdkit-tar-plugin
virt-v2v-man-pages-uk
virt-v2v
virt-v2v-bash-completion
virt-v2v-man-pages-ja
libguestfs-gobject-devel
virt-dib
libguestfs-java
libguestfs-java-devel
libguestfs-rescue
ocaml-libguestfs-devel
ocaml-libguestfs
libguestfs-rsync
libguestfs-tools-c
libguestfs-xfs
lua-guestfs
perl-Sys-Guestfs
python3-libguestfs
ruby-libguestfs
libguestfs-gfs2
libguestfs-inspect-icons
libguestfs-bash-completion
libguestfs-javadoc
libguestfs-man-pages-ja
libguestfs-gobject
libguestfs-man-pages-uk
libguestfs-tools
libguestfs-devel
libguestfs-appliance
libguestfs
qemu-system-x86-microvm (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system (Ubuntu package)
qemu (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-sparc (Ubuntu package)
supermin-devel
supermin
qemu-img
qemu-user-static
qemu-kvm-ui-spice
qemu-kvm-ui-opengl
qemu-guest-agent
qemu-kvm
qemu-kvm-block-curl
qemu-kvm-block-iscsi
qemu-kvm-block-rbd
qemu-kvm-block-ssh
qemu-kvm-common
qemu-kvm-core
qemu-kvm-docs
qemu-kvm-tests
qemu-kvm-hw-usbredir
qemu-kvm-block-gluster
qemu-system-xen (Ubuntu package)
perl-Sys-Virt
python3-libvirt
libvirt-nss
libvirt
libvirt-client
libvirt-daemon
libvirt-daemon-config-network
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-interface
libvirt-daemon-driver-network
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-nwfilter
libvirt-wireshark
libvirt-docs
libvirt-devel
libvirt-daemon-kvm
libvirt-libs
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-rbd
libvirt-lock-sanlock
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-qemu
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret
qemu-kvm (Red Hat package)
libguestfs-winsupport
Red Hat OpenStack

How to mitigate CVE-2023-5088

Install updates from vendor's website.

Juniper Junos Space - update to 24.1R2
netcf - update to 0.2.8-12.0.1
netcf-devel - update to 0.2.8-12.0.1
netcf-libs - update to 0.2.8-12.0.1
swtpm-tools-pkcs11 - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools - update to 0.7.0-4.20211109gitb79fd91
swtpm-libs - update to 0.7.0-4.20211109gitb79fd91
swtpm-devel - update to 0.7.0-4.20211109gitb79fd91
swtpm - update to 0.7.0-4.20211109gitb79fd91
libtpms-devel - update to 0.9.1-2.20211126git1ff6fe1f43
libtpms - update to 0.9.1-2.20211126git1ff6fe1f43
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
libvirt-dbus - update to 1.3.0-2
ruby-hivex - update to 1.3.18-23
hivex-devel - update to 1.3.18-23
python3-hivex - update to 1.3.18-23
perl-hivex - update to 1.3.18-23
hivex - update to 1.3.18-23
ocaml-hivex-devel - update to 1.3.18-23
ocaml-hivex - update to 1.3.18-23
libnbd-devel - update to 1.6.0-5.0.2
nbdfuse - update to 1.6.0-5.0.2
ocaml-libnbd - update to 1.6.0-5.0.2
ocaml-libnbd-devel - update to 1.6.0-5.0.2
libnbd - update to 1.6.0-5.0.2
libnbd-bash-completion - update to 1.6.0-5.0.2
python3-libnbd - update to 1.6.0-5.0.2
seabios-bin - update to 1.16.0-4
seabios - update to 1.16.0-4
seavgabios-bin - update to 1.16.0-4
libiscsi-devel - update to 1.18.0-8.0.1
libiscsi - update to 1.18.0-8.0.1
libiscsi-utils - update to 1.18.0-8.0.1
nbdkit-bash-completion - update to 1.24.0-5
nbdkit-tar-filter - update to 1.24.0-5
nbdkit-xz-filter - update to 1.24.0-5
nbdkit-vddk-plugin - update to 1.24.0-5
nbdkit - update to 1.24.0-5
nbdkit-basic-filters - update to 1.24.0-5
nbdkit-tmpdisk-plugin - update to 1.24.0-5
nbdkit-basic-plugins - update to 1.24.0-5
nbdkit-curl-plugin - update to 1.24.0-5
nbdkit-devel - update to 1.24.0-5
nbdkit-example-plugins - update to 1.24.0-5
nbdkit-gzip-filter - update to 1.24.0-5
nbdkit-gzip-plugin - update to 1.24.0-5
nbdkit-linuxdisk-plugin - update to 1.24.0-5
nbdkit-nbd-plugin - update to 1.24.0-5
nbdkit-python-plugin - update to 1.24.0-5
nbdkit-server - update to 1.24.0-5
nbdkit-ssh-plugin - update to 1.24.0-5
nbdkit-tar-plugin - update to 1.24.0-5
virt-v2v-man-pages-uk - update to 1.42.0-22
virt-v2v - update to 1.42.0-22
virt-v2v-bash-completion - update to 1.42.0-22
virt-v2v-man-pages-ja - update to 1.42.0-22
libguestfs-gobject-devel - update to 1.44.0-9.0.1
virt-dib - update to 1.44.0-9.0.1
libguestfs-java - update to 1.44.0-9.0.1
libguestfs-java-devel - update to 1.44.0-9.0.1
libguestfs-rescue - update to 1.44.0-9.0.1
ocaml-libguestfs-devel - update to 1.44.0-9.0.1
ocaml-libguestfs - update to 1.44.0-9.0.1
libguestfs-rsync - update to 1.44.0-9.0.1
libguestfs-tools-c - update to 1.44.0-9.0.1
libguestfs-xfs - update to 1.44.0-9.0.1
lua-guestfs - update to 1.44.0-9.0.1
perl-Sys-Guestfs - update to 1.44.0-9.0.1
python3-libguestfs - update to 1.44.0-9.0.1
ruby-libguestfs - update to 1.44.0-9.0.1
libguestfs-gfs2 - update to 1.44.0-9.0.1
libguestfs-inspect-icons - update to 1.44.0-9.0.1
libguestfs-bash-completion - update to 1.44.0-9.0.1
libguestfs-javadoc - update to 1.44.0-9.0.1
libguestfs-man-pages-ja - update to 1.44.0-9.0.1
libguestfs-gobject - update to 1.44.0-9.0.1
libguestfs-man-pages-uk - update to 1.44.0-9.0.1
libguestfs-tools - update to 1.44.0-9.0.1
libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-appliance - update to 1.44.0-9.0.1
libguestfs - update to 1.44.0-9.0.1
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21
qemu-system-arm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-mips (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-misc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-ppc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:6.2+dfsg-2ubuntu6.16
qemu-system-s390x (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86 (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-sparc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
supermin-devel - update to 5.2.1-2.0.2
supermin - update to 5.2.1-2.0.2
qemu-img - update to 6.2.0-49.0.1
qemu-user-static - update to 6.2.0-49.0.1
qemu-kvm-ui-spice - update to 6.2.0-49.0.1
qemu-kvm-ui-opengl - update to 6.2.0-49.0.1
qemu-guest-agent - update to 6.2.0-49.0.1
qemu-kvm - update to 6.2.0-49.0.1
qemu-kvm-block-curl - update to 6.2.0-49.0.1
qemu-kvm-block-iscsi - update to 6.2.0-49.0.1
qemu-kvm-block-rbd - update to 6.2.0-49.0.1
qemu-kvm-block-ssh - update to 6.2.0-49.0.1
qemu-kvm-common - update to 6.2.0-49.0.1
qemu-kvm-core - update to 6.2.0-49.0.1
qemu-kvm-docs - update to 6.2.0-49.0.1
qemu-kvm-tests - update to 6.2.0-49.0.1
qemu-kvm-hw-usbredir - update to 6.2.0-49.0.1
qemu-kvm-block-gluster - update to 6.2.0-49.0.1
qemu-system-xen (Ubuntu package) - addressed in versions 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
perl-Sys-Virt - update to 8.0.0-1
python3-libvirt - update to 8.0.0-2
libvirt-nss - update to 8.0.0-23.1.0.1
libvirt - update to 8.0.0-23.1.0.1
libvirt-client - update to 8.0.0-23.1.0.1
libvirt-daemon - update to 8.0.0-23.1.0.1
libvirt-daemon-config-network - update to 8.0.0-23.1.0.1
libvirt-daemon-config-nwfilter - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-interface - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-network - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-nodedev - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-nwfilter - update to 8.0.0-23.1.0.1
libvirt-wireshark - update to 8.0.0-23.1.0.1
libvirt-docs - update to 8.0.0-23.1.0.1
libvirt-devel - update to 8.0.0-23.1.0.1
libvirt-daemon-kvm - update to 8.0.0-23.1.0.1
libvirt-libs - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-scsi - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-rbd - update to 8.0.0-23.1.0.1
libvirt-lock-sanlock - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-mpath - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-qemu - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-logical - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-iscsi-direct - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-iscsi - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-gluster - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-disk - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage-core - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-storage - update to 8.0.0-23.1.0.1
libvirt-daemon-driver-secret - update to 8.0.0-23.1.0.1
qemu-kvm (Red Hat package) - update to 8.2.0-11.el9_4
libguestfs-winsupport - update to 8.10-1
Red Hat OpenStack - update to 17.1

External References

Related Security Bulletins