| Name | CVE-2023-6693 |
| Description | A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| qemu (PTS) | bullseye | 1:5.2+dfsg-11+deb11u3 | vulnerable |
| bullseye (security) | 1:5.2+dfsg-11+deb11u2 | vulnerable | |
| bookworm | 1:7.2+dfsg-7+deb12u12 | fixed | |
| trixie | 1:10.0.0~rc2+ds-2 | fixed | |
| sid | 1:10.0.0~rc3+ds-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| qemu | source | buster | (not affected) | |||
| qemu | source | bookworm | 1:7.2+dfsg-7+deb12u4 | |||
| qemu | source | (unstable) | 1:8.2.0+ds-3 |
[bullseye] - qemu <no-dsa> (Minor issue)
[buster] - qemu <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=2254580
Introduced by: https://gitlab.com/qemu-project/qemu/-/commit/e22f0603fb2fc274920a9e3a1d1306260b9a4cc4 (v5.1.0-rc0)
https://lists.nongnu.org/archive/html/qemu-devel/2024-01/msg00045.html