CVSS: 8.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3682 – QEMU: usbredir: free() call on invalid pointer in bufp_alloc()
https://notcve.org/view.php?id=CVE-2021-3682
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host. Se ha encontrado un fallo en la emulación del dispositivo redirector USB de QEMU en versiones anteriores a 6.1.0-rc2. Ocurre cuando se abandonan paquetes durante una transferencia masiva desde un cliente SPICE debido a que la queue de paquetes está lleno. • https://bugzilla.redhat.com/show_bug.cgi?id=1989651 https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20210902-0006 https://www.debian.org/security/2021/dsa-4980 https://access.redhat.com/security/cve/CVE-2021-3682 • CWE-763: Release of Invalid Pointer or Reference •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3608
https://notcve.org/view.php?id=CVE-2021-3608
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo en la implementación de QEMU del dispositivo RDMA paravirtual de VMWare en versiones anteriores a 6.1.0. El problema es producido mientras es manejada una escritura "PVRDMA_REG_DSRHIGH" desde el huésped y puede resultar en un fallo de QEMU o causar un comportamiento no definido debido a un acceso de un puntero no inicializado. • https://bugzilla.redhat.com/show_bug.cgi?id=1973383 https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07926.html https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20220318-0002 • CWE-824: Access of Uninitialized Pointer •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0CVE-2021-20257 – QEMU: net: e1000: infinite loop while processing transmit descriptors
https://notcve.org/view.php?id=CVE-2021-20257
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo de bucle infinito en el emulador NIC e1000 de QEMU. • https://bugzilla.redhat.com/show_bug.cgi?id=1930087 https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8 https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20220425-0003 https://www.openwall.com/lists/oss-security/2021/02/25/2 https://access.redhat.com/security/cve/CVE-2021-20257 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3546
https://notcve.org/view.php?id=CVE-2021-3546
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code execution with the privileges of the QEMU process. Se ha encontrado una vulnerabilidad de escritura fuera de límites en el dispositivo GPU virtio vhost-user (vhost-user-gpu) de QEMU en las versiones hasta la 6.0 inclusive. El fallo se produce al procesar el comando 'VIRTIO_GPU_CMD_GET_CAPSET' del huésped. • http://www.openwall.com/lists/oss-security/2021/05/31/1 https://bugzilla.redhat.com/show_bug.cgi?id=1958978 https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20210720-0008 https://www.debian.org/security/2021/dsa-4980 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3545
https://notcve.org/view.php?id=CVE-2021-3545
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host. Se ha encontrado una vulnerabilidad de divulgación de información en el dispositivo GPU virtio vhost-user (vhost-user-gpu) de QEMU en las versiones hasta 6.0 incluyéndola. El fallo se presenta en la función virgl_cmd_get_capset_info() en el archivo contrib/vhost-user-gpu/virgl.c y podría ocurrir debido a una lectura de memoria no inicializada. • http://www.openwall.com/lists/oss-security/2021/05/31/1 https://bugzilla.redhat.com/show_bug.cgi?id=1958955 https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20210720-0008 https://www.debian.org/security/2021/dsa-4980 • CWE-908: Use of Uninitialized Resource •