Use-after-free in QEMU - CVE-2023-3019

Vulnerability identifier: #VU85734

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3019

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the e1000e_write_packet_to_guest() function in the e1000e NIC emulation code in QEMU. A local user can trigger DMA reentrancy and crash the QEMU process on the host.

QEMU
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
Server Applications Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
openEuler
Juniper Junos Space
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu-system-common (Ubuntu package)
sgabios-bin
sgabios
qemu-ipxe
qemu-seabios
qemu-vgabios
seavgabios-bin
seabios-bin
seabios
qemu
qemu-block-iscsi
qemu-debugsource
qemu-block-ssh
qemu-img
qemu-debuginfo
qemu-block-rbd
qemu-guest-agent
qemu-block-curl
qemu-help
qemu-system-x86-xen (Ubuntu package)
qemu-system-x86-microvm (Ubuntu package)
qemu-user-static
qemu-kvm-block-rbd
qemu-kvm-block-iscsi
qemu-kvm-block-curl
qemu-kvm-ui-spice
qemu-kvm-ui-opengl
qemu-kvm-hw-usbredir
qemu-kvm-block-gluster
qemu-kvm-tests
qemu-kvm-docs
qemu-kvm-core
qemu-kvm-common
qemu-kvm-block-ssh
qemu-kvm
qemu-system-arm
qemu-system-x86_64
qemu-system-riscv
qemu-system-aarch64
qemu-hw-usb-host
qemu-microvm
qemu-SLOF
qemu-skiboot
qemu-ui-spice-app
qemu-ui-dbus-debuginfo
qemu-hw-display-virtio-vga
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-s390x
qemu-ui-spice-app-debuginfo
qemu-accel-qtest-debuginfo
qemu-chardev-spice-debuginfo
qemu-block-rbd-debuginfo
qemu-chardev-spice
qemu-audio-jack-debuginfo
qemu-audio-alsa-debuginfo
qemu-audio-jack
qemu-guest-agent-debuginfo
qemu-hw-display-qxl-debuginfo
qemu-hw-display-qxl
qemu-ui-opengl
qemu-block-nfs
qemu-extra-debuginfo
qemu-x86
qemu-accel-tcg-x86
qemu-audio-alsa
qemu-audio-oss
qemu-headless
qemu-block-iscsi-debuginfo
qemu-hw-s390x-virtio-gpu-ccw
qemu-block-nfs-debuginfo
qemu-audio-pa
qemu-linux-user-debuginfo
qemu-block-gluster
qemu-audio-dbus
qemu-block-ssh-debuginfo
qemu-ui-curses
qemu-extra
qemu-hw-display-virtio-gpu
qemu-ui-gtk-debuginfo
qemu-ui-spice-core-debuginfo
qemu-block-gluster-debuginfo
qemu-accel-tcg-x86-debuginfo
qemu-ppc-debuginfo
qemu-tools
qemu-chardev-baum-debuginfo
qemu-audio-dbus-debuginfo
qemu-ivshmem-tools-debuginfo
qemu-s390x-debuginfo
qemu-ksm
qemu-block-curl-debuginfo
qemu-arm
qemu-audio-pa-debuginfo
qemu-hw-display-virtio-gpu-pci
qemu-lang
qemu-ppc
qemu-accel-qtest
qemu-hw-usb-host-debuginfo
qemu-vhost-user-gpu-debuginfo
qemu-hw-usb-redirect-debuginfo
qemu-audio-spice-debuginfo
qemu-hw-display-virtio-vga-debuginfo
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-ui-curses-debuginfo
qemu-arm-debuginfo
qemu-ui-gtk
qemu-ui-opengl-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-ui-spice-core
qemu-hw-usb-smartcard
qemu-chardev-baum
qemu-block-dmg-debuginfo
qemu-block-dmg
qemu-linux-user-debugsource
qemu-audio-oss-debuginfo
qemu-audio-spice
qemu-ui-dbus
qemu-hw-usb-smartcard-debuginfo
qemu-x86-debuginfo
qemu-tools-debuginfo
qemu-linux-user
qemu-ivshmem-tools
qemu-vhost-user-gpu
qemu-hw-usb-redirect
qemu-kvm (Red Hat package)
qemu-system-xen (Ubuntu package)
qemu-sgabios
Red Hat OpenStack

Install updates from vendor's website.

Juniper Junos Space - update to 24.1R2
qemu-system (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-arm (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-mips (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-misc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-ppc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-s390x (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-sparc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-x86 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24
qemu-system-aarch64 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
qemu-system-common (Ubuntu package) - update to Ubuntu Pro
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
qemu-ipxe - update to 1.0.0+-150500.49.15.1
qemu-seabios - update to 1.16.0_0_gd239552-150500.49.15.1
qemu-vgabios - update to 1.16.0_0_gd239552-150500.49.15.1
seavgabios-bin - update to 1.16.0-4
seabios-bin - update to 1.16.0-4
seabios - update to 1.16.0-4
qemu - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-block-iscsi - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-debugsource - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-block-ssh - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-img - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-debuginfo - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-block-rbd - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-guest-agent - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-block-curl - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-help - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-seabios - addressed in versions 4.1.0-78, 4.1.0-82, 6.2.0-86, 6.2.0-89
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24
qemu-user-static - update to 6.2.0-41.0.1
qemu-img - update to 6.2.0-41.0.1
qemu-kvm-block-rbd - update to 6.2.0-41.0.1
qemu-kvm-block-iscsi - update to 6.2.0-41.0.1
qemu-kvm-block-curl - update to 6.2.0-41.0.1
qemu-kvm-ui-spice - update to 6.2.0-41.0.1
qemu-kvm-ui-opengl - update to 6.2.0-41.0.1
qemu-kvm-hw-usbredir - update to 6.2.0-41.0.1
qemu-kvm-block-gluster - update to 6.2.0-41.0.1
qemu-kvm-tests - update to 6.2.0-41.0.1
qemu-kvm-docs - update to 6.2.0-41.0.1
qemu-kvm-core - update to 6.2.0-41.0.1
qemu-kvm-common - update to 6.2.0-41.0.1
qemu-kvm-block-ssh - update to 6.2.0-41.0.1
qemu-guest-agent - update to 6.2.0-41.0.1
qemu-kvm - update to 6.2.0-41.0.1
qemu-system-arm - addressed in versions 6.2.0-86, 6.2.0-89
qemu-system-x86_64 - addressed in versions 6.2.0-86, 6.2.0-89
qemu-system-riscv - addressed in versions 6.2.0-86, 6.2.0-89
qemu-system-aarch64 - addressed in versions 6.2.0-86, 6.2.0-89
qemu-hw-usb-host - addressed in versions 6.2.0-86, 6.2.0-89
qemu-microvm - update to 7.1.0-150500.49.15.1
qemu-SLOF - update to 7.1.0-150500.49.15.1
qemu-skiboot - update to 7.1.0-150500.49.15.1
qemu-block-iscsi - update to 7.1.0-150500.49.15.1
qemu-kvm - update to 7.1.0-150500.49.15.1
qemu-ui-spice-app - update to 7.1.0-150500.49.15.1
qemu-ui-dbus-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-virtio-vga - update to 7.1.0-150500.49.15.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 7.1.0-150500.49.15.1
qemu-s390x - update to 7.1.0-150500.49.15.1
qemu-ui-spice-app-debuginfo - update to 7.1.0-150500.49.15.1
qemu-accel-qtest-debuginfo - update to 7.1.0-150500.49.15.1
qemu-chardev-spice-debuginfo - update to 7.1.0-150500.49.15.1
qemu-block-rbd-debuginfo - update to 7.1.0-150500.49.15.1
qemu-block-rbd - update to 7.1.0-150500.49.15.1
qemu-chardev-spice - update to 7.1.0-150500.49.15.1
qemu-audio-jack-debuginfo - update to 7.1.0-150500.49.15.1
qemu-audio-alsa-debuginfo - update to 7.1.0-150500.49.15.1
qemu-audio-jack - update to 7.1.0-150500.49.15.1
qemu-guest-agent-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-qxl-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-qxl - update to 7.1.0-150500.49.15.1
qemu - update to 7.1.0-150500.49.15.1
qemu-ui-opengl - update to 7.1.0-150500.49.15.1
qemu-block-nfs - update to 7.1.0-150500.49.15.1
qemu-extra-debuginfo - update to 7.1.0-150500.49.15.1
qemu-x86 - update to 7.1.0-150500.49.15.1
qemu-accel-tcg-x86 - update to 7.1.0-150500.49.15.1
qemu-audio-alsa - update to 7.1.0-150500.49.15.1
qemu-audio-oss - update to 7.1.0-150500.49.15.1
qemu-headless - update to 7.1.0-150500.49.15.1
qemu-guest-agent - update to 7.1.0-150500.49.15.1
qemu-debugsource - update to 7.1.0-150500.49.15.1
qemu-block-iscsi-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-s390x-virtio-gpu-ccw - update to 7.1.0-150500.49.15.1
qemu-block-nfs-debuginfo - update to 7.1.0-150500.49.15.1
qemu-audio-pa - update to 7.1.0-150500.49.15.1
qemu-block-ssh - update to 7.1.0-150500.49.15.1
qemu-linux-user-debuginfo - update to 7.1.0-150500.49.15.1
qemu-block-gluster - update to 7.1.0-150500.49.15.1
qemu-audio-dbus - update to 7.1.0-150500.49.15.1
qemu-block-ssh-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ui-curses - update to 7.1.0-150500.49.15.1
qemu-extra - update to 7.1.0-150500.49.15.1
qemu-hw-display-virtio-gpu - update to 7.1.0-150500.49.15.1
qemu-ui-gtk-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ui-spice-core-debuginfo - update to 7.1.0-150500.49.15.1
qemu-block-gluster-debuginfo - update to 7.1.0-150500.49.15.1
qemu-accel-tcg-x86-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ppc-debuginfo - update to 7.1.0-150500.49.15.1
qemu-tools - update to 7.1.0-150500.49.15.1
qemu-chardev-baum-debuginfo - update to 7.1.0-150500.49.15.1
qemu-audio-dbus-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ivshmem-tools-debuginfo - update to 7.1.0-150500.49.15.1
qemu-s390x-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ksm - update to 7.1.0-150500.49.15.1
qemu-block-curl-debuginfo - update to 7.1.0-150500.49.15.1
qemu-arm - update to 7.1.0-150500.49.15.1
qemu-audio-pa-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-virtio-gpu-pci - update to 7.1.0-150500.49.15.1
qemu-lang - update to 7.1.0-150500.49.15.1
qemu-ppc - update to 7.1.0-150500.49.15.1
qemu-accel-qtest - update to 7.1.0-150500.49.15.1
qemu-hw-usb-host-debuginfo - update to 7.1.0-150500.49.15.1
qemu-vhost-user-gpu-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-usb-redirect-debuginfo - update to 7.1.0-150500.49.15.1
qemu-audio-spice-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-virtio-vga-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-virtio-gpu-pci-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ui-curses-debuginfo - update to 7.1.0-150500.49.15.1
qemu-block-curl - update to 7.1.0-150500.49.15.1
qemu-arm-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ui-gtk - update to 7.1.0-150500.49.15.1
qemu-ui-opengl-debuginfo - update to 7.1.0-150500.49.15.1
qemu-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-display-virtio-gpu-debuginfo - update to 7.1.0-150500.49.15.1
qemu-ui-spice-core - update to 7.1.0-150500.49.15.1
qemu-hw-usb-smartcard - update to 7.1.0-150500.49.15.1
qemu-chardev-baum - update to 7.1.0-150500.49.15.1
qemu-block-dmg-debuginfo - update to 7.1.0-150500.49.15.1
qemu-block-dmg - update to 7.1.0-150500.49.15.1
qemu-linux-user-debugsource - update to 7.1.0-150500.49.15.1
qemu-audio-oss-debuginfo - update to 7.1.0-150500.49.15.1
qemu-audio-spice - update to 7.1.0-150500.49.15.1
qemu-ui-dbus - update to 7.1.0-150500.49.15.1
qemu-hw-usb-smartcard-debuginfo - update to 7.1.0-150500.49.15.1
qemu-x86-debuginfo - update to 7.1.0-150500.49.15.1
qemu-hw-usb-host - update to 7.1.0-150500.49.15.1
qemu-tools-debuginfo - update to 7.1.0-150500.49.15.1
qemu-linux-user - update to 7.1.0-150500.49.15.1
qemu-ivshmem-tools - update to 7.1.0-150500.49.15.1
qemu-vhost-user-gpu - update to 7.1.0-150500.49.15.1
qemu-hw-usb-redirect - update to 7.1.0-150500.49.15.1
qemu-kvm (Red Hat package) - update to 8.2.0-11.el9_4
qemu-system-xen (Ubuntu package) - addressed in versions 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-sgabios - update to 8-150500.49.15.1
Red Hat OpenStack - update to 17.1

• https://access.redhat.com/security/cve/CVE-2023-3019
• https://bugzilla.redhat.com/show_bug.cgi?id=2222351
• https://security.netapp.com/advisory/ntap-20230831-0005/
• https://access.redhat.com/errata/RHSA-2024:0135

• Denial of service in QEMU
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Red Hat Enterprise Linux 8.8 Extended Update Support update for the virt:rhel and virt-devel:rhel modules
• openEuler 22.03 LTS SP3 update for qemu
• openEuler 22.03 LTS update for qemu
• openEuler 22.03 LTS SP1 update for qemu
• openEuler 22.03 LTS SP2 update for qemu
• openEuler 20.03 LTS SP1 update for qemu
• openEuler 20.03 LTS SP4 update for qemu
• SUSE update for qemu
• Red Hat Enterprise Linux 9 update for qemu-kvm
• Multiple vulnerabilities in Red Hat OpenStack 17.1 packages
• Ubuntu update for qemu
• Multiple vulnerabilities in Junos Space
• Anolis OS update for virt:an module