CVE-2021-3392

NameCVE-2021-3392
DescriptionA use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2623-1
NVD severitylow
Debian Bugs984449

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)stretch1:2.8+dfsg-6+deb9u9vulnerable
stretch (security)1:2.8+dfsg-6+deb9u16fixed
buster, buster (security)1:3.1+dfsg-8+deb10u8vulnerable
bullseye1:5.2+dfsg-11fixed
bullseye (security)1:5.2+dfsg-11+deb11u1fixed
bookworm, sid1:6.1+dfsg-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusourcestretch1:2.8+dfsg-6+deb9u14DLA-2623-1
qemusource(unstable)1:5.2+dfsg-10984449

Notes

[buster] - qemu <postponed> (Minor issue)
https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg00488.html
https://bugs.launchpad.net/qemu/+bug/1914236

Search for package or bug name: Reporting problems