CVE-2021-3748

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Use After Free pada qemu, debian linux +4 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

Rincian

Terbit di NVD

23 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1998514 issue tracking · patch · advisory pihak ketiga
• https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6 patch · advisory pihak ketiga
• https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.html mailing list · patch · advisory pihak ketiga
• https://ubuntu.com/security/CVE-2021-3748 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-27 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220425-0004/ advisory pihak ketiga