QEMU <=8.0.4 NVMe: null ptr deref in directive_receive
CVE-2023-40360 Published on August 14, 2023

QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.

NVD


Products Associated with CVE-2023-40360

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-40360 are published in these products:

QEMU
 
Canonical Ubuntu Linux
 

Exploit Probability

EPSS
0.04%
Percentile
12.23%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.