CVE-2021-3947 — Out-of-bounds Read in Qemu

CWE-125 — Out-of-bounds Read6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 81.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
QemuDebian QemuMsrc Cbl2 Qemu 6.2.0-2 ON CBL Mariner 2.0+5 more
Timeline
PublishedFeb 18
Latest updateFeb 19

Description

A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages10 packages

▶debiandebian/qemu< qemu 1:6.2+dfsg-1 (bookworm)
▶Debianqemu/qemu< 1:6.2+dfsg-1+2
▶NVDqemu/qemu6.0.0 — 6.1.0+1
▶CVEListV5qemu/qemuqemu-kvm 6.2.0-rc2

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-435p-4r6f-2842: A stack-buffer-overflow was found in QEMU in the NVME component↗2022-02-19
▶
OSV
CVE-2021-3947: A stack-buffer-overflow was found in QEMU in the NVME component↗2022-02-18
▶

📋Vendor Advisories

3
Microsoft
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious use↗2022-02-08
▶
Red Hat
QEMU: NVMe: out-of-bounds memory read in nvme_changed_nslist↗2021-11-10
▶
Debian
CVE-2021-3947: qemu - A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies i...↗2021
▶