CVE-2023-2680: Dma reentrancy issue (incomplete fix for cve-2021-3750)

CVE-2023-2680 PUBLISHED CVSS 7.5 HIGH

Dma reentrancy issue (incomplete fix for cve-2021-3750)

Reported by redhat · Published September 13, 2023

This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
n/a	qemu
Red Hat	Red Hat Enterprise Linux 6
Red Hat	Red Hat Enterprise Linux 7
Red Hat	Red Hat Enterprise Linux 7
Red Hat	Red Hat Enterprise Linux 8
Red Hat	Red Hat Enterprise Linux 8 Advanced Virtualization
Red Hat	Red Hat Enterprise Linux 9
Red Hat	Red Hat OpenStack Platform 13 (Queens)
Fedora	Fedora
Fedora	Extra Packages for Enterprise Linux
Red Hat	Red Hat OpenStack Platform 13 (Queens)
Fedora	Extra Packages for Enterprise Linux
Red Hat	Red Hat Enterprise Linux 9
Fedora	Fedora
Red Hat	Red Hat Enterprise Linux 8
n/a	qemu
chainguard	qemu	*
Red Hat	Red Hat Enterprise Linux 7
wolfi	qemu	*
Red Hat	Red Hat Enterprise Linux 7

…and 2 more

Timeline

Sep 13, 2023 CVE Published
Sep 13, 2023 PoC Published
Sep 14, 2023 EPSS Score (30 in total, the first dated here)
Nov 7, 2023 CVE Updated
Mar 21, 2026 Security Advisory (2 in total, the first dated here)
Mar 27, 2026 Distribution Patch

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-2680
vulnetix vdb fixes CVE-2023-2680

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-2680/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

vdb-entryx_refsource_REDHAT
RHBZ#2203387 issue-trackingx_refsource_REDHAT

Look up in the Resolve Platform →