CVEvulnerability

CVE-2023-3301

5.6 MEDIUM Published 2023-09-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-09-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.6 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS 3.1 ([email protected])
5.6 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-362, CWE-617

Description

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.

Affected configurations

• qemu qemu (<= 8.0.3) • redhat enterprise linux 8.0 • redhat enterprise linux 9.0

Related

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-617 Reachable Assertion weakness

References