Bug 2222351 (CVE-2023-3019)

Summary:	CVE-2023-3019 QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ddepaula, jen, jferlan, jmaloy, knoel, mkenneth, mrezanin, mst, pbonzini, virt-maint, ymankad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	qemu-kvm 8.2.0	Doc Type:	If docs needed, set a value
Doc Text:	A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2222352, 2222354, 2222355, 2222356
Bug Blocks:	2211976

Description Mauro Matteo Cascella 2023-07-12 15:15:22 UTC

OSS-Fuzz reported a use-after-free issue in e1000e. This looks similar to https://gitlab.com/qemu-project/qemu/-/issues/1543. However, Alexander Bulekov confirmed that this crashes both on master and v8.0 (albeit with slightly different crash traces).

OSS-Fuzz issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59243

Upstream patch:
https://lists.nongnu.org/archive/html/qemu-devel/2023-05/msg08310.html

Comment 1 Mauro Matteo Cascella 2023-07-12 15:15:42 UTC

Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2222352]

Comment 4 errata-xmlrpc 2024-01-10 11:30:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0135 https://access.redhat.com/errata/RHSA-2024:0135

Comment 5 errata-xmlrpc 2024-01-24 16:41:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0404 https://access.redhat.com/errata/RHSA-2024:0404

Comment 6 errata-xmlrpc 2024-01-30 13:20:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0569 https://access.redhat.com/errata/RHSA-2024:0569

Comment 7 Mauro Matteo Cascella 2024-02-13 15:11:34 UTC

Upstream commits:
https://gitlab.com/qemu-project/qemu/-/commit/7d0fefdf81f5973334c344f6b8e1896c309dff66
https://gitlab.com/qemu-project/qemu/-/commit/9050f976e447444ea6ee2ba12c9f77e4b0dc54bc

Comment 8 errata-xmlrpc 2024-04-30 09:35:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2135 https://access.redhat.com/errata/RHSA-2024:2135