CVE-2023-6683: Qemu: vnc: null pointer dereference in qemu_clipboard_request()
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemuclipboardrequest() function can be reached before vncservercuttextcaps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.
Other sources
It can be that a client sends a VNCMSGCLIENTCUTTEXT message before sending a VNCMSGCLIENTSETENCODINGS message with VNCENCODINGCLIPBOARDEXT for configuring the clipboard extension.
This means that qemuclipboardrequest() can be reached (via vncclientcuttextext()) before vncservercuttextcaps() was called and had the chance to initialize the clipboard peer. In that case, info->owner->request is NULL instead of a function and so attempting to call it in qemuclipboardrequest() results in a segfault.
In particular, this can happen when using the KRDC (22.12.3) VNC client on Wayland. A malicious or misbehaving VNC client can crash QEMU - only after successful authentication.
— Red Hat
Qemu: vnc: null pointer dereference in qemuclipboardrequest()
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6683?
CVE-2023-6683 has been identified as a vulnerability leading to a NULL pointer dereference in the QEMU VNC server.
How do I fix CVE-2023-6683?
To fix CVE-2023-6683, update to QEMU version 9.0.0 or later, or apply the appropriate patches provided by your distribution.
Which versions of QEMU are affected by CVE-2023-6683?
CVE-2023-6683 affects QEMU versions before 9.0.0, including versions between 6.1.0 and 9.0.0.
What software is vulnerable to CVE-2023-6683?
CVE-2023-6683 impacts packages such as qemu-kvm from Red Hat and qemu from Debian.
What is the impact of exploiting CVE-2023-6683?
Exploiting CVE-2023-6683 may lead to unexpected application crashes due to a NULL pointer dereference within the VNC server.