CVE-2023-5088Medium· 6.4▾ SunlitA bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
virt-devel:rhel (all versions)virt:rhel (all versions)qemu-kvm (all versions)qemu-kvmqemu-kvmqemu-kvm-mavirt:av/qemu-kvm (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6683Medium· 6.5Qemu: vnc: null pointer dereference in qemu_clipboard_request()
CVE-2023-3255Medium· 6.5Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
CVE-2023-3019Medium· 6.0Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
CVE-2023-6693Medium· 4.9Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()
CVE-2026-98787Medium· 4.1kernel: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() (CVE-2026-98787)
CVE-2023-53718High· 7.8In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulti…