CVE-2023-3301

2023-09-1317:15:10

Debian Security Bug Tracker

security-tracker.debian.org

qemu

hot-unplug

race scenario

denial of service

net device

virtio-net

pci backend

0.0004 Low

EPSS

Percentile

5.2%

JSON

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.

OSVersionArchitecturePackageVersionFilename
Debian12allqemu< 1:7.2+dfsg-7+deb12u1qemu_1:7.2+dfsg-7+deb12u1_all.deb
Debian11allqemu< 1:5.2+dfsg-11+deb11u3qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian10allqemu< 1:3.1+dfsg-8+deb10u8qemu_1:3.1+dfsg-8+deb10u8_all.deb
Debian999allqemu< 1:8.0.3+dfsg-1qemu_1:8.0.3+dfsg-1_all.deb
Debian13allqemu< 1:8.0.3+dfsg-1qemu_1:8.0.3+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	qemu	< 1:7.2+dfsg-7+deb12u1	qemu_1:7.2+dfsg-7+deb12u1_all.deb
Debian	11	all	qemu	< 1:5.2+dfsg-11+deb11u3	qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian	10	all	qemu	< 1:3.1+dfsg-8+deb10u8	qemu_1:3.1+dfsg-8+deb10u8_all.deb
Debian	999	all	qemu	< 1:8.0.3+dfsg-1	qemu_1:8.0.3+dfsg-1_all.deb
Debian	13	all	qemu	< 1:8.0.3+dfsg-1	qemu_1:8.0.3+dfsg-1_all.deb