CVE-2021-3409Improper Restriction of Operations within the Bounds of a Memory Buffer in Qemu

Severity
5.7MEDIUMNVD
OSV6.3OSV2.3
EPSS
0.2%
top 59.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 23
Latest updateMay 24

Description

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LExploitability: 1.5 | Impact: 3.7

Affected Packages8 packages

debiandebian/qemu< qemu 1:5.2+dfsg-10 (bookworm)
Debianqemu/qemu< 1:5.2+dfsg-10+3
Ubuntuqemu/qemu< 1:2.11+dfsg-1ubuntu7.37+1
NVDqemu/qemu5.2.0

Also affects: Debian Linux 9.0, Fedora 33, Enterprise Linux 7.0

Patches

🔴Vulnerability Details

3
GHSA
GHSA-mx4g-vhmg-3rf6: The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues pre2022-05-24
OSV
qemu vulnerabilities2021-07-15
OSV
CVE-2021-3409: The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues pre2021-03-23

📋Vendor Advisories

4
Ubuntu
QEMU vulnerabilities2021-07-15
Microsoft
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation cod2021-03-09
Debian
CVE-2021-3409: qemu - The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus ma...2021
Red Hat
QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-250852020-12-28

💬Community

1
Bugzilla
CVE-2020-17380 QEMU: heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c2020-07-30