QEMU virtio-net Device virtio_net_flush_tx out_sg stack-based overflow

Summaryinfo

A vulnerability was found in QEMU. It has been rated as critical. The impacted element is the function virtio_net_flush_tx of the component virtio-net Device. This manipulation of the argument out_sg causes stack-based overflow. This vulnerability is tracked as CVE-2023-6693. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability was found in QEMU (Virtualization Software) (version unknown). It has been declared as critical. Affected by this vulnerability is the function virtio_net_flush_tx of the component virtio-net Device. The manipulation of the argument out_sg with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.

The weakness was disclosed 01/02/2024. It is possible to read the advisory at access.redhat.com. This vulnerability is known as CVE-2023-6693 since 12/11/2023. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/02/2025).

The vulnerability scanner Nessus provides a plugin with the ID 209571 (Oracle Linux 8 : virt:kvm_utils3 (ELSA-2024-12792)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (209571) and EUVD (EUVD-2023-58914). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• QEMU

License

• open-source

Website

• Product: https://www.qemu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion