Database/Kernel, userspace & hypervisor
QEMU VNC server: malformed clipboard zlib buffer sends inflate_buffer into an infinite loop
Impact
An authenticated VNC client can send a ClientCutText clipboard message whose zlib payload trips a wrong exit condition in inflate_buffer, spinning QEMU in an infinite loop. The VM stops making progress and the host CPU burns, which on a GPU node means a hung tenant VM holding its passed-through accelerators and a vCPU pinned at 100 percent next to other tenants' work. The reach depends entirely on who can open the VNC console: where QEMU's VNC is exposed to a tenant-facing console proxy rather than restricted to the management network, this is reachable by anyone with console credentials for their own VM.
Who can reach it
Remote, over the network to QEMU's VNC port, with authentication - a client that holds VNC credentials and is able to paste into the console (CVSS AV:N/PR:L).
What to do
Patch qemu-kvm per the Red Hat errata (RHSA-2024:2135, RHSA-2024:2962 for the relevant streams); the fix is in the QEMU binary, so each guest must be restarted or live-migrated onto a patched host before it is covered. Until then, restrict VNC to localhost behind an authenticated console proxy, keep it off any tenant-reachable network, or disable the built-in VNC server on hosts that do not need it.
References
Related entries
- glibc: getaddrinfo in no-aaaa mode leaks stack contents from a large TCP DNS responseCVE-2023-4527 · glibc getaddrinfo (no-aaaa mode, oversized TCP DNS response)Medium
- GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination): A GPU kernel reads whateverCVE-2023-4969 · GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination)Medium
- Linux kernel (net/xfrm): XFRM_MSG_NEWAE lets a caller update replay-window state on a state that never had replay_esnCVE-2023-53147 · Linux kernel (net/xfrm)Medium
- Linux kernel (drivers/vfio): Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to aCVE-2023-53171 · Linux kernel (drivers/vfio)Medium
- Linux kernel (drivers/iommu/iommufd): Iommufd accepts a user address plus length that wraps past zero, then asks the mmCVE-2023-54239 · Linux kernel (drivers/iommu/iommufd)Medium
- QEMU VNC server: ClientCutText before clipboard peer init crashes QEMU via NULL dereferenceCVE-2023-6683 · QEMU built-in VNC server (clipboard peer NULL pointer dereference)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.