CVE-2021-3409

Katalog CVE

CVSS 5.7 · Medium EPSS 0,49%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada qemu, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1928146 issue tracking · patch · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/03/09/1 mailing list · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-27 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210507-0001/ advisory pihak ketiga