CVE-2023-42467

Name of the Vulnerable Software and Affected Versions QEMU versions through 8.0.0

Description The issue is related to a division by zero in the scsi disk reset function in hw/scsi/scsi-disk.c due to incorrect block size checking by scsi disk emulate mode select. This can cause QEMU and the guest to stop immediately. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For QEMU versions through 8.0.0, as a temporary workaround, consider disabling the scsi disk reset function until a patch is available. Restrict access to the hw/scsi/scsi-disk.c module to minimize the risk of exploitation. Avoid using a block size of 256 in the s->qdev.blocksize variable until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.