CVE-2023-3180CWE-122

Heap buffer overflow in virtio_crypto_sym_op_helper()

Medium · published August 3, 2023

CVSS v3.1
6.0
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-08-03T14:31Z
EPSS history
Timeline
  • 03 AUG 14:31Z
    Heap buffer overflow in virtio_crypto_sym_op_helper()
    cvelistv5