CVE-2023-6693

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio net flush tx function if guest features VIRTIO NET F HASH REPORT, VIRTIO F VERSION 1, and VIRTIO NET F MRG RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the out sg variable could be used to read a part of process memory and send it to the wire, causing an information leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.