Vulnerability · Published Feb 25, 2021 · Assigned by redhat
CVE-2021-20203
Low 3.2
In plain English
A low-severity integer overflow in qemu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)3.2Low
Exploit odds (30 days)0.6%top 51.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | qemu | 5.2.0-r0 | ALPINE-CVE-2021-20203 |
| Alpine:v3.21 | qemu | 5.2.0-r0 | ALPINE-CVE-2021-20203 |
| Alpine:v3.22 | qemu | 5.2.0-r0 | ALPINE-CVE-2021-20203 |
| Alpine:v3.23 | qemu | 5.2.0-r0 | ALPINE-CVE-2021-20203 |
| Alpine:v3.24 | qemu | 5.2.0-r0 | ALPINE-CVE-2021-20203 |
| Debian:12 | qemu | 1:6.2+dfsg-1 | DEBIAN-CVE-2021-20203 |
| Debian:13 | qemu | 1:6.2+dfsg-1 | DEBIAN-CVE-2021-20203 |
| Debian:14 | qemu | 1:6.2+dfsg-1 | DEBIAN-CVE-2021-20203 |
| Ubuntu:22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu5 | UBUNTU-CVE-2021-20203 |
Affected products (as reported)
Weakness: CWE-190
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1922441 x_refsource_MISC
- https://bugs.launchpad.net/qemu/+bug/1913873 x_refsource_MISC
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update mailing-list, x_refsource_MLIST
- GLSA-202208-27 vendor-advisory, x_refsource_GENTOO
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update mailing-list, x_refsource_MLIST