CVE-2023-3180: Heap buffer overflow in virtio_crypto_sym_op_helper()

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-03 · updated 2026-06-17
Weakness: CWE-122

Description

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

Affected products

Debian Linux: 10.0
Fedoraproject Fedora: 38
QEMU: before 8.1.0; 8.1.0-rc0, 8.1.0-rc1, 8.1.0-rc2 — fixed in 8.1.0

How to fix

Upgrade to a fixed version: QEMU 8.1.0. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2023-3180
https://bugzilla.redhat.com/show_bug.cgi?id=2222424
https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/
https://security.netapp.com/advisory/ntap-20230831-0008/
https://access.redhat.com/security/cve/CVE-2023-3180
https://bugzilla.redhat.com/show_bug.cgi?id=2222424
https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/
https://security.netapp.com/advisory/ntap-20230831-0008/

Get alerted when CVE-2023-3180 or the next vulnerability affects your stack