CVE-2023-30612

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-30612

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30612.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-30612

Aliases

GHSA-g6mw-f26h-4jgp

Published

2023-04-19T17:25:40.446Z

Modified

2025-12-04T23:49:08.363360Z

Severity

4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor

Details

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our http_api_fuzzer via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30612.json",
    "cwe_ids": [
        "CWE-306"
    ]
}

References

Affected packages

Git / github.com/cloud-hypervisor/cloud-hypervisor

Affected ranges

Type

GIT

Repo

https://github.com/cloud-hypervisor/cloud-hypervisor

Events

Introduced

ece0e6fa92298fffac57f57e3bcc3d5a59874c98

Fixed

93d7e01b417d8192707fefe04012bb68c096947b

Database specific

{
    "versions": [
        {
            "introduced": "30.0"
        },
        {
            "fixed": "30.1"
        }
    ]
}

Type

GIT

Repo

https://github.com/cloud-hypervisor/cloud-hypervisor

Events

Introduced

f3522e85fcb51d184a4010c09acf813f9a7acfc6

Fixed

d530569ac2ac8eaa69dac35ff3248cd8d7b7139a

Database specific

{
    "versions": [
        {
            "introduced": "31.0"
        },
        {
            "fixed": "31.1"
        }
    ]
}

Affected versions

v30.*

v30.0

v31.*

v31.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30612.json"