CVE-2023-3354: Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service.
Other sources
Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service
— Microsoft
When a client connects to the VNC server, QEMU will check whether the current number of connections is greater than the limitation. If so, it will clean up the previous connection. If that connection happens to be in the handshake phase and fails, QEMU will clean up the connection again, which will result in a NULL pointer dereference issue. A remote unauthenticated user could use this flaw to cause a denial of service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 1:4.2-3ubuntu6.28 - Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 1:6.2+dfsg-2ubuntu6.16 - Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-5ubuntu2.4 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:7.2+dfsg-7+deb12u7Fixed in 1:9.0.2+ds-2Fixed in 1:9.1.0+ds-3
Event History
Frequently Asked Questions
What is CVE-2023-3354?
CVE-2023-3354 is a vulnerability found in the QEMU built-in VNC server that allows an attacker to cause denial of service or potentially execute arbitrary code.
How does CVE-2023-3354 affect QEMU?
CVE-2023-3354 affects the QEMU built-in VNC server, specifically when a client connects to the server.
What is the severity of CVE-2023-3354?
The severity of CVE-2023-3354 is rated as high.
What is the impact of CVE-2023-3354?
CVE-2023-3354 can result in denial of service or potentially allow an attacker to execute arbitrary code.
How can I mitigate CVE-2023-3354?
To mitigate CVE-2023-3354, it is recommended to update QEMU to a patched version provided by the vendor or apply the recommended security patches.