Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
CVE-2023-3019

6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.6 Extended Update Support
Red Hat Enterprise Linux 8.8 Extended Update Support
Red Hat Enterprise Linux 9
Vendor
CVE Published:
24 July 2023

What is CVE-2023-3019?

A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.

Affected Version(s)

Red Hat Enterprise Linux 8 8090020231206155326.a75119d5

Red Hat Enterprise Linux 8 8090020231206155326.a75119d5

Red Hat Enterprise Linux 8.6 Extended Update Support 8060020231128234847.ad008a3a

References

https://access.redhat.com/errata/RHSA-2024:0135
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0404
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0569
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2023-3019 : Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()