CVE-2023-6693

Name	CVE-2023-6693
Description	A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	bullseye	1:5.2+dfsg-11+deb11u3	vulnerable
	bullseye (security)	1:5.2+dfsg-11+deb11u2	vulnerable
	bookworm	1:7.2+dfsg-7+deb12u7	fixed
	sid, trixie	1:9.2.0+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
qemu	source	buster	(not affected)
qemu	source	bookworm	1:7.2+dfsg-7+deb12u4
qemu	source	(unstable)	1:8.2.0+ds-3

Notes

[bullseye] - qemu <no-dsa> (Minor issue)
[buster] - qemu <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=2254580
Introduced by: https://gitlab.com/qemu-project/qemu/-/commit/e22f0603fb2fc274920a9e3a1d1306260b9a4cc4 (v5.1.0-rc0)
https://lists.nongnu.org/archive/html/qemu-devel/2024-01/msg00045.html