CVE-2023-42467 is a division-by-zero vulnerability affecting QEMU up to version 8.0.0. Specifically, the scsi_disk_reset function can be triggered to divide by zero if scsi_disk_emulate_mode_select allows s->qdev.blocksize to be 256, leading to an immediate crash of both QEMU and the guest. This vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity and a high impact on availability (denial of service). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.0.0CPE matchmatch criteria | cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-42467
Sep 10, 2024QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
Sep 12, 2023QEMU: am53c974: denial of service due to division by zero
Sep 11, 2023