CVE-2023-2680: Dma reentrancy issue (incomplete fix for cve-2021-3750)
The QEMU flaw CVE-2021-3750 (bug 1999073) was declared fixed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2022:7967, released on Nov 15, 2022:
https://access.redhat.com/errata/RHSA-2022:7967
However, the erratum included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750. The CVE-2023-2680 was assigned to this incomplete fix and it is specific to the qemu-kvm packages produced by Red Hat. This issue and CVE-ID is not applicable to any upstream QEMU version or QEMU packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.
For more information about the original flaw, refer to the CVE page or bug linked above.
Other sources
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-2680?
CVE-2023-2680 is a vulnerability that exists because of an incomplete fix for CVE-2021-3750.
What is the severity of CVE-2023-2680?
CVE-2023-2680 has a severity rating of 8.2 (high).
What software is affected by CVE-2023-2680?
The QEMU QEMU package and Red Hat Enterprise Linux 9.0 are affected by CVE-2023-2680.
What is the fix for CVE-2023-2680?
A complete fix for CVE-2023-2680 has not been provided yet. Please refer to the official references for updates.
Is there any additional information available for CVE-2023-2680?
Yes, you can find more information about CVE-2023-2680 on the official Red Hat security advisory and bugzilla pages.