CVE-2023-3255: Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the inflatebuffer function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.
Other sources
The vncclientcuttextext function in ui/vnc-clipboard.c calls inflatebuffer with an attacker controlled buffer (size, data). There is a wrong exit condition in inflatebuffer which can trigger an infinite loop. A remote authenticated client who is able to send a clipboard to the QEMU built-in VNC server can trigger this flaw and cause a denial of service.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-3255?
CVE-2023-3255 is a vulnerability found in the QEMU built-in VNC server while processing ClientCutText messages.
What is the severity of CVE-2023-3255?
The severity of CVE-2023-3255 is medium (6.5).
How does CVE-2023-3255 affect the software?
CVE-2023-3255 affects QEMU versions up to but not including 8.1.0 and Red Hat Enterprise Linux versions 8.0 and 9.0.
How can CVE-2023-3255 be fixed?
To fix CVE-2023-3255, it is recommended to update QEMU to version 8.1.0 or apply the appropriate remedy provided by Red Hat.
Where can I find more information about CVE-2023-3255?
More information about CVE-2023-3255 can be found at the following references: - [Red Hat Security Advisory](https://access.redhat.com/security/cve/CVE-2023-3255) - [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2218486) - [QEMU Developer Mailing List](https://lists.nongnu.org/archive/html/qemu-devel/2023-07/msg00596.html)