Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-30612 is a medium-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cloudhypervisor Cloud Hypervisor. Its CVSS base score is 4.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34988
Vulnerability Data
Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud…
more
Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our `http_api_fuzzer` via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 9 hardening rules · 4 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can discover use-after-free issues via scanning or analysis but do not prevent their introduction.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Routine patching removes known use-after-free instances after they have been introduced in released software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. blocks CWE-306
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. blocks CWE-416
- V-248827 OL 8 must not have the rsh-server package installed. blocks CWE-306
RHEL 7 (2 rules)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. blocks CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. blocks CWE-306
RHEL 8 (3 rules)
- V-230492 RHEL 8 must not have the rsh-server package installed. blocks CWE-306
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. blocks CWE-416
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. blocks CWE-306
RHEL 9 (1 rule)
- V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. blocks CWE-416