CVE-2023-40360 | BDVDB-2026-209685 Detail

Description#

QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://gitlab.com/qemu-project/qemu/-/issues/1815
https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b239812dee5211881426496da7b98
https://www.qemu.org/docs/master/system/security.html
https://security.netapp.com/advisory/ntap-20230915-0004/

Exploit#

No public exploit known

History#

Version 12023-08-14Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.