CVE-2023-3019 — Use After Free in Qemu

CWE-416 — Use After Free9 documents8 sources
Severity
6.5MEDIUMNVD
CNA6.0OSV3.5
EPSS
0.0%
top 98.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
QemuRedhat Enterprise Linux
Timeline
PublishedJul 24
Latest updateNov 8

Description

A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 2.0 | Impact: 4.0

Affected Packages3 packages

▶NVDqemu/qemu< 8.2.0
▶Debianqemu/qemu< 1:5.2+dfsg-11+deb11u4+3
▶Ubuntuqemu/qemu< 1:4.2-3ubuntu6.30+5

Also affects: Enterprise Linux 8.0, 9.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
OSV
qemu vulnerabilities↗2024-11-08
▶
GHSA
GHSA-786x-44fx-qqh8: A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU↗2023-07-24
▶
CVEList
Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()↗2023-07-24
▶
OSV
CVE-2023-3019: A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU↗2023-07-24
▶

📋Vendor Advisories

4
Ubuntu
QEMU vulnerabilities↗2024-11-08
▶
Microsoft
Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()↗2023-07-11
▶
Red Hat
QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest()↗2023-06-01
▶
Debian
CVE-2023-3019: qemu - A DMA reentrancy issue leading to a use-after-free error was found in the e1000e...↗2023
▶
CVE-2023-3019 — Use After Free in Qemu | cvebase