NULL pointer dereference in QEMU - CVE-2023-40360

Vulnerability identifier: #VU85829

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40360

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nvme_directive_receive() function in hw/nvme/ctrl.c. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

QEMU
Ubuntu
qemu-system-mips (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-x86-microvm (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-xen (Ubuntu package)

Install updates from vendor's website.

qemu-system-mips (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-s390x (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-sparc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-ppc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86 (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:6.2+dfsg-2ubuntu6.16
qemu-system-misc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21
qemu-system-arm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-xen (Ubuntu package) - addressed in versions 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2

• https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b239812dee5211881426496da7b98
• https://gitlab.com/qemu-project/qemu/-/issues/1815
• https://www.qemu.org/docs/master/system/security.html
• https://security.netapp.com/advisory/ntap-20230915-0004/

• Denial of service in QEMU nvme
• Ubuntu update for qemu
• Ubuntu update for qemu