Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-3255: QEMU VNC server can crash from clipboard data

CVE-2023-3255 · published 3 years ago

Summary

The built‑in VNC service in QEMU may get stuck in a loop when it processes clipboard text sent by a connected user. An attacker who is already logged in to the VNC session could cause the server to stop responding, effectively causing a denial of service. Apply the latest QEMU updates from your Linux distribution to fix the problem.

What to do

Update debian qemu to version 1:7.2+dfsg-7+deb12u2.
Update debian qemu to version 1:8.0.4+dfsg-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	qemu	< 1:7.2+dfsg-7+deb12u2 Fix: upgrade to 1:7.2+dfsg-7+deb12u2
Debian:13	debian	qemu	< 1:8.0.4+dfsg-1 Fix: upgrade to 1:8.0.4+dfsg-1
Debian:14	debian	qemu	< 1:8.0.4+dfsg-1 Fix: upgrade to 1:8.0.4+dfsg-1
–	qemu	qemu	<= 8.0.3 `cpe:2.3:a:qemu:qemu::::::::`
–	redhat	enterprise_linux	8.0 9.0 `cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*`
–	fedoraproject	fedora	38 `cpe:2.3:o:fedoraproject:fedora:38:::::::*`

Original advisory text

Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service

A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.

References

https://security-tracker.debian.org/tracker/CVE-2023-3255 Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:2135 Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:2962 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-3255 Vendor Advisory
https://security.netapp.com/advisory/ntap-20231020-0008/ Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2218486 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3255.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-3255 Vendor Advisory
https://access.redhat.com/downloads/content/package-browser/ URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')

Timeline

Published13 Sep 2023

Updated3 Nov 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2023-3255 · OSV

CVE-2023-3255 · NVD

CVE-2023-3255 · OSV

Track software like this

Free during beta