CVE-2023-4135

Fixed in a distro release EPSS <1%CVSS 6.0

A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

Published 2023-08-04 · CVE record · OSV

Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9, Fedora, Fedora Extra Packages for Enterprise Linux

Distro releases