Homepage

Stack-based Buffer Overflow The advisory has been revoked - it doesn't affect any version of package virt:rhel/qemu-kvm-tests  (opens in a new tab)

Threat Intelligence

EPSS
0.33% (25th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-VIRT-6141817
  • published2 Jan 2024
  • disclosed2 Jan 2024
Report a new vulnerability Found a mistake?

Introduced: 2 Jan 2024

CVE-2023-6693  (opens in a new tab)
CWE-121  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream virt:rhel/qemu-kvm-tests package and not the virt:rhel/qemu-kvm-tests package as distributed by RHEL.

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the out_sg variable could be used to read a part of process memory and send it to the wire, causing an information leak.