GPU VulnDB

Database/Kernel, userspace & hypervisor

QEMU VNC server: ClientCutText before clipboard peer init crashes QEMU via NULL dereference

CVSS 6.5CVE-2023-6683Kernel, userspace & hypervisorcurated

Impact

qemu_clipboard_request() can be reached before vnc_server_cut_text_caps() has initialized the clipboard peer, so a malicious VNC client that sends clipboard data in the wrong order dereferences NULL and QEMU dies. The tenant VM disappears along with its passed-through GPUs and any unsaved training state; the host survives, but the job does not. This is a separate code path and a separate fix from the ClientCutText zlib loop in CVE-2023-3255 even though both sit in the same VNC clipboard handling and ship in the same errata. Exposure follows whoever can reach the VNC socket - keep it to the management side and only operators can trigger it.

Who can reach it

Remote to QEMU's VNC port, authenticated: a VNC client holding console credentials for the VM (CVSS AV:N/PR:L).

What to do

Patch qemu-kvm per the Red Hat errata (RHSA-2024:2135, RHSA-2024:2962); as with any QEMU fix, running guests must be restarted or migrated to a patched host to pick it up. Interim: bind VNC to localhost behind an authenticated proxy, or disable the built-in VNC server where it is not needed.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-6683https://access.redhat.com/security/cve/CVE-2023-6683https://access.redhat.com/errata/RHSA-2024:2135https://bugzilla.redhat.com/show_bug.cgi?id=2254825

Related entries

All Kernel, userspace & hypervisor entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.