Log in Start free

Vulnerability · Published Mar 9, 2021 · Assigned by redhat

CVE-2021-20255

Medium 5.5

In plain English

A medium-severity infinite loop in QEMU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.4%top 64.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20qemu6.0.0-r1ALPINE-CVE-2021-20255
Alpine:v3.21qemu6.0.0-r1ALPINE-CVE-2021-20255
Alpine:v3.22qemu6.0.0-r1ALPINE-CVE-2021-20255
Alpine:v3.23qemu6.0.0-r1ALPINE-CVE-2021-20255
Alpine:v3.24qemu6.0.0-r1ALPINE-CVE-2021-20255
Debian:12qemuno fix listedDEBIAN-CVE-2021-20255
Debian:13qemu1:8.1.0+ds-1DEBIAN-CVE-2021-20255
Debian:14qemu1:8.1.0+ds-1DEBIAN-CVE-2021-20255
Ubuntu:22.04:LTSqemuno fix listedUBUNTU-CVE-2021-20255
Ubuntu:24.04:LTSqemuno fix listedUBUNTU-CVE-2021-20255
Ubuntu:25.10qemuno fix listedUBUNTU-CVE-2021-20255
Ubuntu:26.04:LTSqemuno fix listedUBUNTU-CVE-2021-20255
Ubuntu:26.10qemuno fix listedUBUNTU-CVE-2021-20255
Ubuntu:26.04:LTSqemu-hweno fix listedUBUNTU-CVE-2021-20255
Ubuntu:26.10qemu-hweno fix listedUBUNTU-CVE-2021-20255

Affected products (as reported)

VendorProductVersions
n/a QEMU all versions

Weakness: CWE-835

References