CVE-2021-3392

Katalog CVE

CVSS 3.2 · Low EPSS 0,45%

Kerentanan Use After Free pada qemu, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 3.2 (Low) menurut NVD.

Deskripsi (NVD)

A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.2 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1924042 issue tracking · patch · advisory pihak ketiga
• https://bugs.launchpad.net/qemu/+bug/1914236 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210507-0001/ advisory pihak ketiga