Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-3354: QEMU VNC server can be crashed by remote client
CVE-2023-3354 · published 3 years ago
Summary
The built-in VNC service in QEMU may stop working if an unauthenticated user connects and triggers a connection cleanup during the handshake. This causes the program to try to use a missing reference, leading to a crash that stops the service. Apply the latest QEMU updates or patches to prevent the crash.
What to do
- Update canonical qemu to version 1:4.2-3ubuntu6.28.
- Update canonical qemu to version 1:6.2+dfsg-2ubuntu6.16.
- Update debian qemu to version 1:7.2+dfsg-7+deb12u2.
- Update debian qemu to version 1:8.0.4+dfsg-1.
- Update qemu qemu to version 8.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | qemu | All versions |
| Ubuntu:20.04:LTS | canonical | qemu |
< 1:4.2-3ubuntu6.28 Fix: upgrade to 1:4.2-3ubuntu6.28
|
| Ubuntu:22.04:LTS | canonical | qemu |
< 1:6.2+dfsg-2ubuntu6.16 Fix: upgrade to 1:6.2+dfsg-2ubuntu6.16
|
| Debian:12 | debian | qemu |
< 1:7.2+dfsg-7+deb12u2 Fix: upgrade to 1:7.2+dfsg-7+deb12u2
|
| Debian:13 | debian | qemu |
< 1:8.0.4+dfsg-1 Fix: upgrade to 1:8.0.4+dfsg-1
|
| Debian:14 | debian | qemu |
< 1:8.0.4+dfsg-1 Fix: upgrade to 1:8.0.4+dfsg-1
|
| – | qemu | qemu |
< 8.1.0 8.1.0 cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* |
| – | redhat | openstack_platform |
13.0 cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
7.0 8.0 9.0 cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
38 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
Original advisory text
Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service.
References
- https://ubuntu.com/security/CVE-2023-3354 Third Party Advisory
- https://lists.nongnu.org/archive/html/qemu-devel/2023-07/msg02668.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-6567-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-3354 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-3354 Vendor Advisory
- https://access.redhat.com/downloads/content/package-browser/ URL
- https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://packages.fedoraproject.org/ URL
- https://access.redhat.com/security/cve/CVE-2023-3354 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3354.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-3354 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2216478 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-476NULL Pointer Dereference
Timeline
Published11 Jul 2023
Updated3 Nov 2026
First seen2 Jun 2026
Sources
UBUNTU-CVE-2023-3354 · OSV
CVE-2023-3354 · NVD
DEBIAN-CVE-2023-3354 · OSV
CVE-2023-3354 · OSV
Track software like this
Free during beta