Host process crash via undersized SCSI block size
Published Sep 11, 2023 · Updated Sep 26, 2024
Division by zero in QEMU 8.0.0 and earlier allows guest OS users to crash the QEMU process and stop the guest via SCSI commands. scsi_disk_emulate_mode_select accepts a 256-byte block size, so scsi_disk_reset later divides by a zero sector ratio. A privileged guest OS user must issue crafted commands to the emulated am53c974 SCSI device; the arithmetic exception terminates that VM's QEMU process and immediately stops the guest.
Summary
What happened
Division by zero in QEMU 8.0.0 and earlier allows guest OS users to crash the QEMU process and stop the guest via SCSI commands. scsi_disk_emulate_mode_select accepts a 256-byte block size, so scsi_disk_reset later divides by a zero sector ratio. A privileged guest OS user must issue crafted commands to the emulated am53c974 SCSI device; the arithmetic exception terminates that VM's QEMU process and immediately stops the guest.
The record
- CVE
- CVE-2023-42467
- Published
- Sep 11, 2023
- Updated
- Sep 26, 2024
- Vendor
- Unknown vendor
- Product
- Unknown product
- Classifications
- CWE-369, T1499.004
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Sep 11, 2023CVE publishedPublication date reported by the CVE source.
- Sep 26, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
What conditions does exploitation require?
What is affected?
Affected products and versions are unavailable in this record.
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- QEMU am53c974 division-by-zero reproducerproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo