CVE-2021-3750
QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
Se ha encontrado un problema de reentrada DMA en la emulación del controlador USB EHCI de QEMU. EHCI no verifica si el puntero del búfer es solapado con su región MMIO cuando transfiere los paquetes USB. El contenido diseñado puede escribirse en los registros del controlador y desencadenar acciones no deseadas (como el reinicio) mientras el dispositivo sigue transfiriendo paquetes. Esto puede conllevar en última instancia a un problema de uso de memoria previamente liberada. Un huésped malicioso podría usar este fallo para bloquear el proceso de QEMU en el host, resultando en una condición de denegación de servicio, o potencialmente ejecutar código arbitrario dentro del contexto del proceso de QEMU en el host. Este fallo afecta a QEMU versiones anteriores a 7.0.0
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-08-30 CVE Reserved
- 2022-05-02 CVE Published
- 2024-07-24 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://gitlab.com/qemu-project/qemu/-/issues/556 | Third Party Advisory | |
https://security.netapp.com/advisory/ntap-20220624-0003 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://gitlab.com/qemu-project/qemu/-/issues/541 | 2024-08-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=1999073 | 2023-02-12 | |
https://security.gentoo.org/glsa/202208-27 | 2023-02-12 | |
https://access.redhat.com/security/cve/CVE-2021-3750 | 2024-01-30 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | < 7.0.0 Search vendor "Qemu" for product "Qemu" and version " < 7.0.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | advanced_virtualization |
Affected
|