CVE-2023-2680

This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

A user who installs or updates to Red Hat Enterprise Linux 9.1 would be vulnerable to the CVE-2021-3750, even if it was declared fixed in the following advisory:

https://access.redhat.com/errata/RHSA-2022:7967

The advisory provided updates for qemu-kvm package, but did not actually include fixes for CVE-2021-3750. The CVE-2023-2680 was assigned to this Red Hat specific issue and it is not applicable to any upstream QEMU version or QEMU packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.

For more details about the original security flaw CVE-2021-3750, refer to the CVE page: https://access.redhat.com/security/cve/CVE-2021-3750.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.