CVE-2021-4207

Katalog CVE

CVSS 8.2 · High EPSS 0,40%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada qemu, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

Rincian

Terbit di NVD

29 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2036966 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-27 advisory pihak ketiga
• https://starlabs.sg/advisories/21-4207/ exploit · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5133 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20250321-0009/