Vulnerability · Published Aug 25, 2021 · Assigned by redhat

CVE-2021-3713

High 7.4

In plain English

A high-severity out-of-bounds write in QEMU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.4High

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	qemu	1:6.1+dfsg-2	DEBIAN-CVE-2021-3713
Debian:13	qemu	1:6.1+dfsg-2	DEBIAN-CVE-2021-3713
Debian:14	qemu	1:6.1+dfsg-2	DEBIAN-CVE-2021-3713
Ubuntu:22.04:LTS	qemu	1:6.2+dfsg-2ubuntu5	UBUNTU-CVE-2021-3713

Affected products (as reported)

Vendor	Product	Versions
n/a	QEMU	qemu 6.2.0-rc0

Weakness: CWE-787

References

https://bugzilla.redhat.com/show_bug.cgi?id=1994640 x_refsource_MISC
[debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update mailing-list, x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20210923-0006/ x_refsource_CONFIRM
DSA-4980 vendor-advisory, x_refsource_DEBIAN
GLSA-202208-27 vendor-advisory, x_refsource_GENTOO
[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update mailing-list, x_refsource_MLIST