Vulnerability · Published Mar 23, 2021 · Assigned by redhat

CVE-2021-3409

Medium 5.7

In plain English

A medium-severity memory corruption in QEMU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.7Medium

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	qemu	6.0.0-r1	ALPINE-CVE-2021-3409
Alpine:v3.21	qemu	6.0.0-r1	ALPINE-CVE-2021-3409
Alpine:v3.22	qemu	6.0.0-r1	ALPINE-CVE-2021-3409
Alpine:v3.23	qemu	6.0.0-r1	ALPINE-CVE-2021-3409
Alpine:v3.24	qemu	6.0.0-r1	ALPINE-CVE-2021-3409
Debian:12	qemu	1:5.2+dfsg-10	DEBIAN-CVE-2021-3409
Debian:13	qemu	1:5.2+dfsg-10	DEBIAN-CVE-2021-3409
Debian:14	qemu	1:5.2+dfsg-10	DEBIAN-CVE-2021-3409

Affected products (as reported)

Vendor	Product	Versions
n/a	QEMU	up to (including) 5.2.0

Weakness: CWE-119

References

https://bugzilla.redhat.com/show_bug.cgi?id=1928146 x_refsource_MISC
https://www.openwall.com/lists/oss-security/2021/03/09/1 x_refsource_MISC
[debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update mailing-list, x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20210507-0001/ x_refsource_CONFIRM
GLSA-202208-27 vendor-advisory, x_refsource_GENTOO