Published: 02/05/2022 Updated: 12/02/2023

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

CVSS v3 Base Score: 8.2 | Impact Score: 6 | Exploitability Score: 1.5

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions prior to 7.0.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu
redhat enterprise linux 8.0

Several security issues were fixed in QEMU ...

Synopsis Moderate: virt:rhel and virt-devel:rhel security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 88 Ext ...

Synopsis Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the virt:rhel and virt-devel:rhel modules is now available for Red Ha ...

Synopsis Moderate: qemu-kvm security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for qemu-kvm is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rate ...

A DMA reentrancy issue was found in the EHCI controller emulation of QEMU When EHCI tries to transfer the USB packets, it doesn't check if the buffer pointer is overlapped with its MMIO region So crafted content may be written to the controller's registers and trigger actions like reset, but the device is still transferring packets This flaw cou ...

CWE-416 https://gitlab.com/qemu-project/qemu/-/issues/556 https://bugzilla.redhat.com/show_bug.cgi?id=1999073 https://gitlab.com/qemu-project/qemu/-/issues/541 https://security.netapp.com/advisory/ntap-20220624-0003/https://security.gentoo.org/glsa/202208-27 https://ubuntu.com/security/notices/USN-5772-1 https://nvd.nist.gov

CVE-2021-3750

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect