CVE-2023-40360

Summary

CVE-2023-40360 is a vulnerability affecting QEMU versions up to 8.0.4. This issue arises due to a NULL pointer access in the function "nvme_directive_receive" located in "hw/nvme/ctrl.c". The root cause is the absence of a check to determine if an endurance group has been configured before enabling Flexible Data Placement. Consequently, the software may crash or exhibit unpredictable behavior when handling NVMe commands, posing a potential security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.