CVE-2021-4206

Katalog CVE

CVSS 8.2 · High EPSS 0,83%

Kerentanan Integer Overflow or Wraparound pada qemu, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

Rincian

Terbit di NVD

29 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2036998 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-27 advisory pihak ketiga
• https://starlabs.sg/advisories/21-4206/ exploit · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5133 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20250321-0010/