Bug 2218486 (CVE-2023-3255) - CVE-2023-3255 QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service
Summary: CVE-2023-3255 QEMU: VNC: infinite loop in inflate_buffer() leads to denial of...
Keywords:
Status: NEW
Alias: CVE-2023-3255
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2218488 2218489 2219543
Blocks: 2203252
TreeView+ depends on / blocked
 
Reported: 2023-06-29 10:52 UTC by Mauro Matteo Cascella
Modified: 2023-09-22 19:02 UTC (History)
11 users (show)

Fixed In Version: qemu 8.1.0-rc0
Doc Type: ---
Doc Text:
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-06-29 10:52:04 UTC
The `vnc_client_cut_text_ext` function in ui/vnc-clipboard.c calls `inflate_buffer` with an attacker controlled buffer (size, data). There is a wrong exit condition in `inflate_buffer` which can trigger an infinite loop. A remote authenticated client who is able to send a clipboard to the QEMU built-in VNC server can trigger this flaw and cause a denial of service.

Comment 3 Mauro Matteo Cascella 2023-07-04 08:52:01 UTC
Proposed patch:
https://lists.nongnu.org/archive/html/qemu-devel/2023-07/msg00596.html

Comment 4 Mauro Matteo Cascella 2023-07-04 08:52:25 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2219543]

Comment 6 Mauro Matteo Cascella 2023-07-24 16:00:48 UTC
Upstream commit:
https://gitlab.com/qemu-project/qemu/-/commit/d921fea3


Note You need to log in before you can comment on or make changes to this bug.