In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memory providers. An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of the correct length. Users are advised to upgrade. There are no known workarounds for this issue.

The version of kata-containers installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-41051 advisory.

  - In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual     device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The     vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memory providers. An     issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref,     aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds     memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less     than the function's `count` argument. No implementations of `get_slice` provided in `vm_memory` are     affected. Users of custom `VolatileMemory` implementations May be impacted if the custom implementation     does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in     version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of     the correct length. Users are advised to upgrade. There are no known workarounds for this issue.
    (CVE-2023-41051)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-eb87748e07 advisory.

    Rebuild dependent packages for vm-memory v0.12.2 to address CVE-2023-41051 / RUSTSEC-2023-0056.

    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41051
    - https://rustsec.org/advisories/RUSTSEC-2023-0056.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-8e6ae98f81 advisory.

    Rebuild dependent packages for vm-memory v0.12.2 to address CVE-2023-41051 / RUSTSEC-2023-0056.

    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41051
    - https://rustsec.org/advisories/RUSTSEC-2023-0056.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-c19aaa2283 advisory.

    Rebuild dependent packages for vm-memory v0.12.2 to address CVE-2023-41051 / RUSTSEC-2023-0056.

    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41051
    - https://rustsec.org/advisories/RUSTSEC-2023-0056.html


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1db67725f2 advisory.

    Rebuild dependent packages for vm-memory v0.12.2 to address CVE-2023-41051 / RUSTSEC-2023-0056.

    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41051
    - https://rustsec.org/advisories/RUSTSEC-2023-0056.html


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201679	CBL Mariner 2.0 Security Update: kata-containers (CVE-2023-41051)	Nessus	MarinerOS Local Security Checks	medium
194631	Fedora 40 : firecracker / virtiofsd (2023-eb87748e07)	Nessus	Fedora Local Security Checks	medium
185205	Fedora 39 : firecracker / virtiofsd (2023-8e6ae98f81)	Nessus	Fedora Local Security Checks	medium
182085	Fedora 38 : firecracker / libkrun / virtiofsd (2023-c19aaa2283)	Nessus	Fedora Local Security Checks	medium
182078	Fedora 37 : firecracker (2023-1db67725f2)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-41051

medium

Tenable Plugins

medium

medium

medium

medium

medium