CVE-2023-2680

2023-09-1317:15:09

Debian Security Bug Tracker

security-tracker.debian.org

qemu-kvm

red hat enterprise linux 9.1

incomplete fix

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

47.6%

JSON

This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

OSVersionArchitecturePackageVersionFilename
Debian12allqemu< 1:7.2+dfsg-7+deb12u7qemu_1:7.2+dfsg-7+deb12u7_all.deb
Debian11allqemu< 1:5.2+dfsg-11+deb11u3qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian999allqemu< 1:9.1.0+ds-7qemu_1:9.1.0+ds-7_all.deb
Debian13allqemu< 1:9.0.2+ds-2qemu_1:9.0.2+ds-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	qemu	< 1:7.2+dfsg-7+deb12u7	qemu_1:7.2+dfsg-7+deb12u7_all.deb
Debian	11	all	qemu	< 1:5.2+dfsg-11+deb11u3	qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian	999	all	qemu	< 1:9.1.0+ds-7	qemu_1:9.1.0+ds-7_all.deb
Debian	13	all	qemu	< 1:9.0.2+ds-2	qemu_1:9.0.2+ds-2_all.deb