CVE-2023-0330: Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-06 · updated 2026-06-17
Weakness: CWE-121

Description

A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.

Affected products

Debian Linux: 10.0
QEMU: from 7.2.0 before 7.2.3; 8.0.0, 8.0.0-rc0, 8.0.0-rc1, 8.0.0-rc2, 8.0.0-rc3, 8.0.0-rc4 — fixed in 7.2.3

How to fix

Upgrade to a fixed version: QEMU 7.2.3. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2023-0330
https://bugzilla.redhat.com/show_bug.cgi?id=2160151
https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html
https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
https://access.redhat.com/security/cve/CVE-2023-0330
https://bugzilla.redhat.com/show_bug.cgi?id=2160151
https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html
https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html

Get alerted when CVE-2023-0330 or the next vulnerability affects your stack