CVE-2021-20181 — Time-of-check Time-of-use (TOCTOU) Race Condition in Qemu
Severity
7.5HIGHNVD
OSV3.8
EPSS
0.1%
top 82.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 13
Latest updateMay 24
Description
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 0.8 | Impact: 6.0
Affected Packages6 packages
Also affects: Debian Linux 10.0, 9.0
Patches
🔴Vulnerability Details
3📋Vendor Advisories
4Microsoft▶
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error potentially escalating their↗2021-05-11
Debian▶
CVE-2021-20181: qemu - A race condition flaw was found in the 9pfs server implementation of QEMU up to ...↗2021