CVE-2023-5088 - Improper Synchronization

Severity

70%

Complexity

10%

Confidentiality

98%

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

CVSS 3.1 Base Score 7. CVSS Attack Vector: local. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Overview

First reported 1 year ago

2023-11-03 14:15:00

Last updated 1 year ago

2023-12-08 19:15:00

Affected Software

QEMU

Red Hat Enterprise Linux 8.0

8.0

Red Hat Enterprise Linux 8.0 Advanced Virtualization Edition

8.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=2247283

https://access.redhat.com/security/cve/CVE-2023-5088

https://lore.kernel.org/all/[email protected]/T/

https://bugzilla.redhat.com/show_bug.cgi?id=2247283

Issue Tracking, Patch

https://access.redhat.com/security/cve/CVE-2023-5088

Third Party Advisory

https://lore.kernel.org/all/[email protected]/T/

Mailing List, Patch

https://security.netapp.com/advisory/ntap-20231208-0005/

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.