CVE-2023-3301

    Dashboard / Vulnerabilities / CVE-2023-3301

    CVE-2023-3301

    Published: 13 Sept 2023Last Modified: 12 Aug 2026

    Summary: Triggerable assertion due to race condition in hot-unplug

    Details: A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.

    References: https://access.redhat.com/downloads/content/package-browser/, https://packages.fedoraproject.org/, https://access.redhat.com/security/cve/CVE-2023-3301, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3301.json, https://nvd.nist.gov/vuln/detail/CVE-2023-3301, https://security.netapp.com/advisory/ntap-20231020-0008/, https://bugzilla.redhat.com/show_bug.cgi?id=2215784

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v8.0.3
    v8.0.2
    v8.0.0
    v8.0.1
    v8.0.0-rc4
    v8.0.0-rc3
    v8.0.0-rc2
    v8.0.0-rc1
    v8.0.0-rc0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-3301 | CVE-DB