A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and just like it when the reentrancy write triggers the reset function nvme_ctrl_reset() data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host resulting in a denial of service condition or potentially executing arbitrary code within the context of the QEMU process on the host.

🗓️ 05 Aug 2024 07:00:00Reported by MicrosoftType

DMA reentrancy in QEMU NVM Express emulation can trigger reset, causing use after free and host crash or code execution.

Reporter	Title	Published	Views	Family All 213
GithubExploit	Exploit for Use After Free in Qemu	13 May 202205:33	–	githubexploit
ALT Linux	Security fix for the ALT Linux 10 package qemu version 6.1.1-alt1	1 Mar 202200:00	–	altlinux
ATTACKERKB	CVE-2023-2680	13 Sep 202317:15	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0021: virt:rhel and virt-devel:rhel (ALINUX3-SA-2024:0021)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : qemu-kvm (ALSA-2022:7967)	19 Nov 202200:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: qemu / qemu-kvm (CVE-2021-3750)	10 Feb 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: qemu (CVE-2021-3929)	10 Feb 202500:00	–	nessus
Tenable Nessus	CentOS 9 : qemu-kvm-8.0.0-8.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.10.0 : qemu (EulerOS-SA-2022-2100)	15 Jul 202200:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.10.1 : qemu (EulerOS-SA-2022-2120)	14 Jul 202200:00	–	nessus