# CVE-2023-3019: QEMU use-after-free in e1000e NIC emulation

Source: https://junglewise.ai/threats/cve-2023-3019-qemu-use-after-free-in-e1000e-nic-emulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-24. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2023-3019 · Severity: medium · CVSS 6 · Published 2023-07-24

A vulnerability was found in QEMU, a widely used virtualization tool that allows computers to run multiple operating systems simultaneously. A user with administrative privileges within a virtual machine could exploit a flaw in the simulated network hardware to crash the host system. This results in a denial of service, potentially disrupting all other virtual machines and services running on that same physical server.

## Quick answers

**Is CVE-2023-3019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-3019 being exploited in the wild.

**How severe is CVE-2023-3019?** Medium severity, with a CVSS score of 6, published 24 July 2023.

**Which products and versions are affected?** QEMU Project QEMU up to (excluding) 8.2.0; Red Hat Enterprise Linux 8, 9.

**Is there a fix for CVE-2023-3019?** A patch was published on 2024-01-10: Red Hat released security updates for RHEL 8 (RHSA-2024:0135) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-3019 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2023-3019?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in QEMU's e1000e network interface card (NIC) emulation, specifically within the e1000e_write_packet_to_guest() function. The flaw is triggered by a DMA reentrancy issue where nested I/O operations can lead to the premature freeing of memory buffers that are still in use. A privileged attacker within a guest virtual machine can trigger this condition to cause a heap use-after-free, resulting in the crash of the QEMU process on the host (Denial of Service). The issue is addressed in QEMU version 8.2.0 and various vendor-specific patches from Red Hat and Debian.

## Affected products

- QEMU Project QEMU up to (excluding) 8.2.0
- Red Hat Enterprise Linux 8, 9

## Timeline

- 2023-07-24: disclosed: Initial NVD publication
- 2024-01-10: patched: Red Hat released security updates for RHEL 8 (RHSA-2024:0135)
- 2024-01-24: patched: Red Hat released security updates for RHEL 8.6 EUS (RHSA-2024:0404)

## References

- [https://access.redhat.com/errata/RHSA-2024:0135](https://access.redhat.com/errata/RHSA-2024:0135)
- [https://access.redhat.com/errata/RHSA-2024:0404](https://access.redhat.com/errata/RHSA-2024:0404)
- [https://access.redhat.com/errata/RHSA-2024:0569](https://access.redhat.com/errata/RHSA-2024:0569)
- [https://access.redhat.com/errata/RHSA-2024:2135](https://access.redhat.com/errata/RHSA-2024:2135)
- [https://access.redhat.com/security/cve/CVE-2023-3019](https://access.redhat.com/security/cve/CVE-2023-3019)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2222351](https://bugzilla.redhat.com/show_bug.cgi?id=2222351)
- [https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html](https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html)