Cloud Hypervisor 30.0/31.0 HTTP API Socket missing authentication

Summaryinfo

A vulnerability was found in Cloud Hypervisor 30.0/31.0. It has been rated as critical. This issue affects some unknown processing of the component HTTP API Socket. The manipulation leads to missing authentication. This vulnerability is referenced as CVE-2023-30612. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cloud Hypervisor 30.0/31.0 (Cloud Software). It has been rated as problematic. This issue affects an unknown function of the component HTTP API Socket. The manipulation with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our `http_api_fuzzer` via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only.

The weakness was published 04/19/2023 as GHSA-g6mw-f26h-4jgp. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-30612 since 04/13/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 30.1 or 31.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Name

• Cloud Hypervisor

Version

• 30.0
• 31.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion