CVE-2021-3507

Name	CVE-2021-3507
Description	A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-3099-1
Debian Bugs	987410

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	buster	1:3.1+dfsg-8+deb10u8	vulnerable
	buster (security)	1:3.1+dfsg-8+deb10u10	fixed
	bullseye (security), bullseye	1:5.2+dfsg-11+deb11u2	vulnerable
	bookworm, sid	1:7.2+dfsg-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
qemu	source	buster	1:3.1+dfsg-8+deb10u9		DLA-3099-1
qemu	source	(unstable)	1:7.1+dfsg-1			987410

Notes

[bullseye] - qemu <no-dsa> (Minor issue)
[stretch] - qemu <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1951118
https://gitlab.com/qemu-project/qemu/-/commit/defac5e2fbddf8423a354ff0454283a2115e1367 (v7.1.0-rc0)
https://gitlab.com/qemu-project/qemu/-/commit/46609b90d9e3a6304def11038a76b58ff43f77bc (v7.1.0-rc0)