CVE-2023-6693

CVSS 3.1 Score 4.9 of 10 (medium)

Details

Published Jan 2, 2024
Updated: Mar 8, 2024
CWE ID 787
CWE ID 121

Summary

CVE-2023-6693 is a vulnerability that affects the virtio-net device of QEMU. It is a stack-based buffer overflow that can be exploited by a malicious user if certain guest features, such as VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1, and VIRTIO_NET_F_MRG_RXBUF, are enabled. This vulnerability allows the attacker to overwrite local variables on the stack, specifically the out_sg variable, leading to an information leak. The affected products include various versions of QEMU. To remediate this vulnerability, it is recommended to update to the latest version of QEMU. This vulnerability has a medium severity rating and can be exploited locally with no privileges required. It has a low impact on confidentiality and integrity, and low availability impact. The CVSS score for this vulnerability is 4.9 out of 10.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-6693 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options