PT-2023-22809 · Unknown · Cloud Hypervisor

Likebreath · Published 2023-04-19 · Updated 2023-05-01 · CVE-2023-30612

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Hypervisor versions 30.0 through 31.0

Description This issue allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP requests through the HTTP API socket, potentially causing Deny-of-Service (DoS) and possibly a Use-After-Free (UAF) vulnerability. Users need write access to the API socket file to trigger this issue. The vulnerability was initially detected by the http api fuzzer via oss-fuzz.

Recommendations For Cloud Hypervisor versions 30.0 through 31.0, upgrade to version 30.1 or 31.1 to resolve the issue. For users unable to upgrade, ensure the write access to the API socket file is granted to trusted users only as a mitigation measure.

Exploit

Fix

Missing Authentication

Use After Free

Weakness Enumeration

CWE-306

CWE-416

Related Identifiers

AZL-26278

CVE-2023-30612

GHSA-G6MW-F26H-4JGP

Affected Products

Cloud Hypervisor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30612.json · Exploit
• https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-g6mw-f26h-4jgp · Vendor Advisory
• https://github.com/cloud-hypervisor/cloud-hypervisor/pull/5350 · Patch
• https://github.com/cloud-hypervisor/cloud-hypervisor/pull/5373 · Patch
• https://osv.dev/vulnerability/CVE-2023-30612 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-26278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30612 · Security Note
• https://t.me/cibsecurity/62472 · Telegram Post
• https://t.me/cvenotify/49535 · Telegram Post
• https://oss-fuzz.com/testcase-detail/5426283514560512 · Note
• https://oss-fuzz.com/testcase-detail/5260873569796096 · Note