CVE-2023-3301 Triggerable assertion due to race condition in hot-unplug

Medium 5.6 Published 13 Sep 2023 Updated 13 Feb 2025

A malicious guest can trigger a denial of service in QEMU by exploiting a race condition during hot-unplug operations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-3301?

CVE-2023-3301 is a medium-severity vulnerability in Qemu Qemu, published on 13 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.

Weakness: CWE-362, CWE-617

Which versions are affected by CVE-2023-3301?

It affects 2 products.

Products include Qemu Qemu, Redhat Enterprise Linux.

How do I fix CVE-2023-3301?

Apply the vendor's patch.

Is CVE-2023-3301 being exploited?

There is no known exploitation of CVE-2023-3301 in the wild and no public exploit code.

All Qemu Qemu vulnerabilities

Sources

Also known as AZL-28790, AZL-35170, BELL-CVE-2023-3301, DEBIAN-CVE-2023-3301, GHSA-cp42-9j6q-v649, UBUNTU-CVE-2023-3301.