CVE-2021-3607 — Integer Overflow or Wraparound in Qemu
Severity
6.0MEDIUMNVD
OSV2.3
EPSS
0.2%
top 61.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Latest updateFeb 25
Description
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HExploitability: 1.5 | Impact: 4.0
Affected Packages8 packages
Also affects: Debian Linux 10.0, Fedora 34
Patches
🔴Vulnerability Details
3📋Vendor Advisories
4Microsoft▶
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due↗2022-02-08
Debian▶
CVE-2021-3607: qemu - An integer overflow was found in the QEMU implementation of VMWare's paravirtual...↗2021