A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Qemu | Qemu | 6.1.0 (including) | 9.0.0 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | virt-devel:rhel-8100020240314161907.e155f54d | * |
| Red Hat Enterprise Linux 8 | RedHat | virt:rhel-8100020240314161907.e155f54d | * |
| Red Hat Enterprise Linux 9 | RedHat | qemu-kvm-17:8.2.0-11.el9_4 | * |
| Qemu | Ubuntu | bionic | * |
| Qemu | Ubuntu | jammy | * |
| Qemu | Ubuntu | lunar | * |
| Qemu | Ubuntu | mantic | * |
| Qemu | Ubuntu | trusty | * |
| Qemu | Ubuntu | upstream | * |
| Qemu | Ubuntu | xenial | * |