CVE-2021-3682

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1989651	Issue Tracking Patch
https://security.netapp.com/advisory/ntap-20210902-0006/	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html	Third Party Advisory
https://www.debian.org/security/2021/dsa-4980	Third Party Advisory
https://security.gentoo.org/glsa/202208-27	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:qemu:qemu:6.1.0:rc1:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:6.1.0:-:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

---

Published : 2021-08-05 08:15

Updated : 2022-10-25 08:28

---

NVD link : CVE-2021-3682

Mitre link : CVE-2021-3682

Enterprise Linux

Redhat

CWE-763