QEMU: DMA reentrancy use-after-free in e1000e emulation lets a guest crash the host QEMU process

Impact

A privileged user inside a guest can drive the emulated e1000e device into a DMA reentrancy path and hit a use-after-free, killing the QEMU process on the host. For an operator that is the loss of one VM - and on a GPU host that VM is usually a whole passed-through accelerator set, so the blast radius is a tenant's training job plus whatever shared state it held, not a recoverable container restart. Red Hat scores it as denial of service only; the record does not claim code execution. Fleets that give tenants VMs with emulated NICs alongside VFIO GPUs are the exposed shape; hosts using virtio-net or SR-IOV VFs rather than e1000e emulation are not in the path.

Who can reach it

A privileged (root-equivalent) user inside a guest VM whose machine type includes an emulated e1000e NIC. Local to the guest, no host credentials needed.

What to do

Patch qemu-kvm from the Red Hat errata (RHSA-2024:0135, 0404, 0569, 2135 depending on the stream). The fix lands in the QEMU binary, so running guests keep the vulnerable code until each one is restarted or live-migrated onto a patched host - plan it as a rolling migrate/restart rather than a hot patch. Interim mitigation: switch guest NIC models away from e1000e to virtio-net or an SR-IOV VF.

References

Related entries

• QEMU VNC server: malformed clipboard zlib buffer sends inflate_buffer into an infinite loopCVE-2023-3255 · QEMU built-in VNC server (ClientCutText zlib inflate_buffer infinite loop)Medium
• glibc: getaddrinfo in no-aaaa mode leaks stack contents from a large TCP DNS responseCVE-2023-4527 · glibc getaddrinfo (no-aaaa mode, oversized TCP DNS response)Medium
• GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination): A GPU kernel reads whateverCVE-2023-4969 · GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination)Medium
• Linux kernel (net/xfrm): XFRM_MSG_NEWAE lets a caller update replay-window state on a state that never had replay_esnCVE-2023-53147 · Linux kernel (net/xfrm)Medium
• Linux kernel (drivers/vfio): Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to aCVE-2023-53171 · Linux kernel (drivers/vfio)Medium
• Linux kernel (drivers/iommu/iommufd): Iommufd accepts a user address plus length that wraps past zero, then asks the mmCVE-2023-54239 · Linux kernel (drivers/iommu/iommufd)Medium