CVE-2023-6693Medium· 4.9▾ SunlitA stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF ar…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the out_sg variable could be used to read a part of process memory and send it to the wire, causing an information leak.
virt-devel:rhel (all versions)virt:rhel (all versions)qemu-kvm (all versions)qemu-kvmqemu-kvmqemu-kvm-mavirt:av/qemu-kvm (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6683Medium· 6.5Qemu: vnc: null pointer dereference in qemu_clipboard_request()
CVE-2023-3255Medium· 6.5Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
CVE-2026-123151High· 7.5Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail
CVE-2026-121994High· 8.8Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length
CVE-2026-121995High· 7.5Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail
CVE-2024-1151Medium· 5.5Kernel: stack overflow problem in open vswitch kernel module leading to dos