CVE-2023-0664

Katalog CVE

CVSS 7.8 · High EPSS 0,31%

Kerentanan Execution with Unnecessary Privileges pada qemu, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.

Rincian

Terbit di NVD

29 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges
CWE-269: Improper Privilege Management

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2167423 issue tracking · patch · advisory pihak ketiga
• https://gitlab.com/qemu-project/qemu/-/commit/07ce178a2b0768eb9e712bb5ad0cf6dc7fcf0158 patch
• https://gitlab.com/qemu-project/qemu/-/commit/88288c2a51faa7c795f053fc8b31b1c16ff804c5 patch
• https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg01445.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MURWGXDIF2WTD...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEOC7SRJWLZSX...
• https://security.netapp.com/advisory/ntap-20230517-0005/