CVE-2021-3592

Katalog CVE

CVSS 3.8 · Low EPSS 0,33%

Kerentanan Access of Uninitialized Pointer pada libslirp project libslirp, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 3.8 (Low) menurut NVD.

Deskripsi (NVD)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Rincian

Terbit di NVD

15 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.8 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-824: Access of Uninitialized Pointer

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1970484 issue tracking · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/09/msg00004.html advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-44 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210805-0004/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTO...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDS...