CVE-2023-5088

2023-11-0314:15:08

Debian Security Bug Tracker

security-tracker.debian.org

qemu

guest i/o operation

disk offset

vm's boot code

l2 guests

l1 hypervisor

virtual disk

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.2%

JSON

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM’s boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

OSVersionArchitecturePackageVersionFilename
Debian12allqemu< 1:7.2+dfsg-7+deb12u3qemu_1:7.2+dfsg-7+deb12u3_all.deb
Debian11allqemu<= 1:5.2+dfsg-11+deb11u3qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian10allqemu< 1:3.1+dfsg-8+deb10u12qemu_1:3.1+dfsg-8+deb10u12_all.deb
Debian999allqemu< 1:8.1.1+ds-2qemu_1:8.1.1+ds-2_all.deb
Debian13allqemu< 1:8.1.1+ds-2qemu_1:8.1.1+ds-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	qemu	< 1:7.2+dfsg-7+deb12u3	qemu_1:7.2+dfsg-7+deb12u3_all.deb
Debian	11	all	qemu	<= 1:5.2+dfsg-11+deb11u3	qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian	10	all	qemu	< 1:3.1+dfsg-8+deb10u12	qemu_1:3.1+dfsg-8+deb10u12_all.deb
Debian	999	all	qemu	< 1:8.1.1+ds-2	qemu_1:8.1.1+ds-2_all.deb
Debian	13	all	qemu	< 1:8.1.1+ds-2	qemu_1:8.1.1+ds-2_all.deb