Published: 05/08/2021 Updated: 31/03/2023

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 8.5 | Impact Score: 6 | Exploitability Score: 1.8

VMScore: 535

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

A flaw was found in the USB redirector device emulation of QEMU in versions before 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu 6.1.0
qemu qemu
redhat enterprise linux 8.0
debian debian linux 9.0
debian debian linux 10.0
debian debian linux 11.0

Debian Bug report logs - #991911 qemu: CVE-2021-3682: free call on invalid pointer in bufp_alloc() Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 5 Aug 2021 07:57:02 UTC Severity: important Tags ...

Several security issues were fixed in QEMU ...

Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service or the the execution of arbitrary code For the stable distribution (bullseye), these problems have been fixed in version 1:52+dfsg-11+deb11u1 We recommend that you upgrade your qemu packages For the detailed security status of qe ...

A flaw was found in the USB redirector device emulation of QEMU It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privil ...

A security issue was found in the USB redirector device emulation of QEMU It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with ...

CWE-763 https://bugzilla.redhat.com/show_bug.cgi?id=1989651 https://security.netapp.com/advisory/ntap-20210902-0006/https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html https://www.debian.org/security/2021/dsa-4980 https://security.gentoo.org/glsa/202208-27 https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991911 https://nvd.nist.gov https://ubuntu.com/security/notices/USN-5307-1

CVE-2021-3682

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect