Bug 2222424 (CVE-2023-3180) - CVE-2023-3180 QEMU: virtio-crypto: heap buffer overflow in virtio_crypto_sym_op_helper()
Summary: CVE-2023-3180 QEMU: virtio-crypto: heap buffer overflow in virtio_crypto_sym_...
Alias: CVE-2023-3180
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Nobody
QA Contact:
Depends On: 2222427 2228748
Blocks: 2213628
TreeView+ depends on / blocked
Reported: 2023-07-12 17:20 UTC by Mauro Matteo Cascella
Modified: 2023-08-04 07:25 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
Clone Of:
Last Closed: 2023-08-03 13:05:56 UTC

Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-07-12 17:20:02 UTC
A heap buffer overflow was found in virtio_crypto_sym_op_helper() in hw/virtio/virtio-crypto.c. It could occur while handling data encryption/dencryption requests in virtio_crypto_handle_sym_req(). There is no check for the value of the src_len and the dst_len in virtio_crypto_sym_op_helper(), so if src_len is not equal to dst_len, a heap based buff overflow occurs while encrypting/dencrypting the data.

Comment 3 Mauro Matteo Cascella 2023-08-03 07:17:52 UTC
Upstream patch:

Comment 4 Mauro Matteo Cascella 2023-08-03 07:18:12 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2228748]

Comment 5 Product Security DevOps Team 2023-08-03 13:05:54 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 6 Mauro Matteo Cascella 2023-08-04 07:25:01 UTC
Upstream commit:

Note You need to log in before you can comment on or make changes to this bug.