CVE-2023-3019

MEDIUM

QEMU - Use After Free

Title source: llm

Description

A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.

References (8)

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2024:0135

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2024:0404

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2024:0569

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:2135

[Third Party Advisory] https://access.redhat.com/security/cve/CVE-2023-3019

[Issue Tracking, Patch, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=2222351

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20230831-0005/

Scores

CVSS v3 6.0

EPSS 0.0001

EPSS Percentile 1.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Classification

CWE

CWE-416

Status published

Affected Products (4)

qemu/qemu < 8.2.0

redhat/enterprise_linux

Timeline

Published Jul 24, 2023

Tracked Since Feb 18, 2026