CVE-2023-40360

    Dashboard / Vulnerabilities / CVE-2023-40360

    CVE-2023-40360

    Published: 14 Aug 2023Last Modified: 12 Aug 2026

    Summary:

    Details: QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.

    References: https://www.qemu.org/docs/master/system/security.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40360.json, https://nvd.nist.gov/vuln/detail/CVE-2023-40360, https://security.netapp.com/advisory/ntap-20230915-0004/, https://gitlab.com/qemu-project/qemu/-/issues/1815, https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b239812dee5211881426496da7b98

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4
    Fixed -None

    Affected versions

    v8.0.4
    v8.0.3
    v8.0.2
    v8.0.0
    v8.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40360 | CVE-DB