Vulnerability Details : CVE-2023-0664
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
Exploit prediction scoring system (EPSS) score for CVE-2023-0664
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2023-0664
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
[email protected] |
CWE ids for CVE-2023-0664
-
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.Assigned by: [email protected] (Secondary)
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: [email protected] (Primary)
References for CVE-2023-0664
-
https://gitlab.com/qemu-project/qemu/-/commit/07ce178a2b0768eb9e712bb5ad0cf6dc7fcf0158
Patch
-
https://security.netapp.com/advisory/ntap-20230517-0005/
-
https://gitlab.com/qemu-project/qemu/-/commit/88288c2a51faa7c795f053fc8b31b1c16ff804c5
Patch
-
https://lists.fedoraproject.org/archives/list/[email protected]/message/SEOC7SRJWLZSXCND2ADFW6C76ZMTZLE4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/
-
https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg01445.html
Mailing List;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=2167423
Issue Tracking;Patch;Third Party Advisory
Products affected by CVE-2023-0664
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*