CVE-2023-5088

Qemu: improper ide controller reset can lead to mbr overwrite

Severity Score

7.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

Un error en QEMU podría causar que una operación de E/S de invitado que de otro modo estaría dirigida a un desplazamiento de disco arbitrario se dirija al desplazamiento 0 (potencialmente sobrescribiendo el código de arranque de la VM). Esto podría ser utilizado, por ejemplo, por invitados L2 con un disco virtual (vdiskL2) almacenado en un disco virtual de un hipervisor L1 (vdiskL1) para leer y/o escribir datos en el LBA 0 de vdiskL1, obteniendo potencialmente el control de L1 en su próximo reinicio.

*Credits: N/A

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-09-20 CVE Reserved
2023-11-03 CVE Published
2023-11-14 EPSS Updated
2024-09-13 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-662: Improper Synchronization
CWE-821: Incorrect Synchronization

CAPEC

References (7)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html
https://security.netapp.com/advisory/ntap-20231208-0005	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://bugzilla.redhat.com/show_bug.cgi?id=2247283	2024-05-22
https://lore.kernel.org/all/20230921160712.99521-1-simon.rowe@nutanix.com/T	2024-05-22

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2024:2135	2024-05-22
https://access.redhat.com/errata/RHSA-2024:2962	2024-05-22
https://access.redhat.com/security/cve/CVE-2023-5088	2024-05-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				< 8.2.0 Search vendor "Qemu" for product "Qemu" and version " < 8.2.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"		advanced_virtualization		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				9.0 Search vendor "Redhat" for product "Enterprise Linux" and version "9.0"		-		Affected