QEMU <=8.0.4 NVMe: null ptr deref in directive_receive
CVE-2023-40360 Published on August 14, 2023
QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.
Products Associated with CVE-2023-40360
stack.watch emails you whenever new vulnerabilities are published in QEMU or Canonical Ubuntu Linux. Just hit a watch button to start following.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.