CVE-2023-1544: Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
Other sources
Guest driver allocates and initialize page tables to be used as a ring of descriptors for CQ and async events. Since the guest controls the number of pages passed to the device, this flaw could lead to an out-of-bounds read and potential crash of QEMU.
Upstream patch: https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html
— Red Hat
Qemu: pvrdma: out-of-bounds read in pvrdmaringnextelemread()
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-1544?
CVE-2023-1544 is a vulnerability found in the QEMU implementation of VMWare's paravirtual RDMA device.
What is the severity of CVE-2023-1544?
The severity of CVE-2023-1544 is medium, with a CVSS score of 6.3.
How does CVE-2023-1544 affect QEMU?
CVE-2023-1544 allows a crafted guest driver to allocate and initialize a huge number of page tables, potentially leading to an out-of-bounds read and crash of QEMU.
How can I fix CVE-2023-1544?
To fix CVE-2023-1544, update your QEMU version to 7.2.0 or later.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-1544?
The CWE IDs for CVE-2023-1544 are CWE-770 and CWE-125.