{"id":"CVE-2023-2680","aliases":["ALSA-2023:6368","CLSA-2025-1760021660","EUVD-2023-34144","GHSA-69cm-qhp7-ch23","RHSA-2023:6368"],"status":"published","title":"Dma reentrancy issue (incomplete fix for cve-2021-3750)","description":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00236,"percentile":0.14677,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2023-09-13T16:50:53Z","modified":"2026-10-29T11:31:33Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-dbus-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debugsource","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-docs","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tests-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-dbus-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper-debuginfo","fixed_in":["17:8.0.0-16.el9_3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.0.0-16.el9_3"}]}]}],"products":[{"vendor":"fedora","product":"extra packages for enterprise linux"},{"vendor":"fedora","product":"fedora"},{"vendor":"qemu","product":"qemu"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8 advanced virtualization"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-2680","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203387","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20231116-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2680","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-69cm-qhp7-ch23"},{"url":"https://access.redhat.com/errata/RHSA-2023:6368","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2203387","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6368.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1760021660.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://packages.fedoraproject.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2680.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1886123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934134","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1946716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174676","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2207940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2220866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229868","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-1218","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6368.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2680","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-2680","title":"Dma reentrancy issue (incomplete fix for cve-2021-3750)","description":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.","status":"published","published":"2023-09-13T16:50:53.532Z","modified":"2025-02-13T16:44:57.37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-34144","description":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.","status":"published","published":"2023-09-13T16:50:53Z","modified":"2025-02-13T16:44:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:50.947767Z"}],"ghsa":[{"id":"GHSA-69cm-qhp7-ch23","title":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm...","description":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.","status":"published","published":"2023-09-13T18:31:26Z","modified":"2023-11-25T05:04:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:55:06.358976Z"}],"nvd":[{"id":"CVE-2023-2680","description":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.","status":"published","published":"2023-09-13T17:15:09.697Z","modified":"2026-06-17T05:53:10.747Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-2680","title":"Dma reentrancy issue (incomplete fix for cve-2021-3750)","description":"This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.","status":"published","published":"2023-09-13T16:50:53.532Z","modified":"2026-10-28T02:31:04.672407419Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"RHSA-2023:6368","title":"Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update","status":"published","published":"2024-09-13T19:00:56Z","modified":"2026-06-29T10:51:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"ALSA-2023:6368","title":"Moderate: qemu-kvm security, bug fix, and enhancement update","description":"Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nThe following packages have been upgraded to a later upstream version: qemu-kvm (8.0.0). (BZ#2180898)\n\nSecurity Fix(es):\n\n* QEMU: hcd-ehci: DMA reentrancy issue (incomplete fix for CVE-2021-3750) (CVE-2023-2680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:33.926294969Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2025-1760021660","title":"qemu-kvm: Fix of 3 CVEs","description":"- CVE-2021-3750: fix for DMA reentrancy use-after-free\n- CVE-2023-2680: final fix for CVE-2021-3750\n- CVE-2023-0330: fix reentrancy in LSI53c895a SCSI controller","status":"published","published":"2025-10-09T14:54:24Z","modified":"2026-10-21T10:45:31.501522042Z","updated_at":"2026-11-02T15:43:42.427288Z"}]}}