Junglewise Threat Intelligence

CVE-2023-3019: QEMU use-after-free in e1000e NIC emulation

CVE-2023-3019 · Severity: medium · CVSS 6 · Published 2023-07-24

Technologies: Red Hat Enterprise Linux, QEMU Project Qemu. Vendors: Red Hat.

Executive brief

A vulnerability was found in QEMU, a widely used virtualization tool that allows computers to run multiple operating systems simultaneously. A user with administrative privileges within a virtual machine could exploit a flaw in the simulated network hardware to crash the host system. This results in a denial of service, potentially disrupting all other virtual machines and services running on that same physical server.

Technical details

A use-after-free vulnerability exists in QEMU's e1000e network interface card (NIC) emulation, specifically within the e1000e_write_packet_to_guest() function. The flaw is triggered by a DMA reentrancy issue where nested I/O operations can lead to the premature freeing of memory buffers that are still in use. A privileged attacker within a guest virtual machine can trigger this condition to cause a heap use-after-free, resulting in the crash of the QEMU process on the host (Denial of Service). The issue is addressed in QEMU version 8.2.0 and various vendor-specific patches from Red Hat and Debian.

Affected products

  • QEMU Project QEMU up to (excluding) 8.2.0
  • Red Hat Enterprise Linux 8, 9

Timeline

  • 2023-07-24: disclosed: Initial NVD publication
  • 2024-01-10: patched: Red Hat released security updates for RHEL 8 (RHSA-2024:0135)
  • 2024-01-24: patched: Red Hat released security updates for RHEL 8.6 EUS (RHSA-2024:0404)

References