CVE-2023-42467 - Vulnerability Details - OpenCVE

QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Qemu	Qemu
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
qemu-kvm-17:8.2.0-11.el9_4	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:2135	2024-04-30T00:00:00Z

References

Link	Providers
https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c
https://gitlab.com/qemu-project/qemu/-/issues/1813
https://nvd.nist.gov/vuln/detail/CVE-2023-42467
https://security.netapp.com/advisory/ntap-20231103-0005/
https://www.cve.org/CVERecord?id=CVE-2023-42467

History

Thu, 26 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-09-11T00:00:00

Updated: 2024-09-26T17:36:32.735Z

Reserved: 2023-09-11T00:00:00

Link: CVE-2023-42467

Vulnrichment

Updated: 2024-08-02T19:23:39.279Z

NVD

Status : Modified

Published: 2023-09-11T04:15:10.720

Modified: 2024-11-21T08:22:36.597

Link: CVE-2023-42467

Redhat

Severity : Low

Publid Date: 2023-09-11T00:00:00Z

Links: CVE-2023-42467 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*", "matchCriteriaId": "5172ED53-5D28-4A36-8A5E-61EF17F0ED53", "versionEndIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately."}, {"lang": "es", "value": "QEMU hasta 8.0.0 podr\u00eda desencadenar una divisi\u00f3n por cero en scsi_disk_reset en hw/scsi/scsi-disk.c porque scsi_disk_emulate_mode_select no impide que s->qdev.blocksize sea 256. Esto detiene QEMU y el invitado inmediatamente."}], "id": "CVE-2023-42467", "lastModified": "2024-11-21T08:22:36.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-11T04:15:10.720", "references": [{"source": "cve@mitre.org", "url": "https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://gitlab.com/qemu-project/qemu/-/issues/1813"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20231103-0005/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://gitlab.com/qemu-project/qemu/-/issues/1813"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20231103-0005/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-369"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:2135", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "qemu-kvm-17:8.2.0-11.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "QEMU: am53c974: denial of service due to division by zero", "id": "2238291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238291"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "verified"}, "cwe": "CWE-369", "details": ["QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.", "A denial of service vulnerability was found in the qemu package. A division by zero in the scsi_disk_reset function can cause QEMU and the guest to stop immediately."], "name": "CVE-2023-42467", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm-ma", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "virt:rhel/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:advanced_virtualization:8::el8", "fix_state": "Will not fix", "package_name": "virt:av/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8 Advanced Virtualization"}], "public_date": "2023-09-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-42467\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42467\nhttps://gitlab.com/qemu-project/qemu/-/issues/1813"], "statement": "Triggering this bug requires kernel or root privileges in the guest VM because it requires direct hardware access. Anyone who has these privileges could also just perform a regular shutdown of the VM, with only a very slightly different result.", "threat_severity": "Low"}