Read the docs
TI-2023-14428 Aliases CVE-2023-30612

Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor

Priority LOW 22CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306, CWE-416 and the CVSS impact.

Summary

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our `http_api_fuzzer` via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0036 29th percentileScored 2026-11-07
Fix Fixed cloud-hypervisor (cloud-hypervisor): 30.1, 31.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloud-hypervisorcloud-hypervisor30.0 to before 30.1; 31.0 to before 31.130.1, 31.1Patch availableCNA
  • cloud-hypervisor Vendorcloud-hypervisor Affected 30.0 to before 30.1; 31.0 to before 31.1 Fixed in 30.1, 31.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:cloudhypervisor:cloud_hypervisor:30.0:*:*:*:*:rust:*:*30.0Vulnerablecloud-hypervisor
cpe:2.3:a:cloudhypervisor:cloud_hypervisor:31.1:*:*:*:*:rust:*:*31.1Vulnerablecloud-hypervisor
  • cpe:2.3:a:cloudhypervisor:cloud_hypervisor:30.0:*:*:*:*:rust:*:* Versions 30.0 Vulnerable ·cloud-hypervisor
  • cpe:2.3:a:cloudhypervisor:cloud_hypervisor:31.1:*:*:*:*:rust:*:* Versions 31.1 Vulnerable ·cloud-hypervisor

Remediation

  • Fix · CNA cloud-hypervisor (cloud-hypervisor) Fixed in 30.1, 31.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30612

References

Patch 3

Other 2

  • TI-2026-21644 Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse CVSS 4.0CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences