CVE-2021-3544

NameCVE-2021-3544
DescriptionSeveral memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4980-1
NVD severitylow
Debian Bugs989042

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)stretch1:2.8+dfsg-6+deb9u9fixed
stretch (security)1:2.8+dfsg-6+deb9u16fixed
buster, buster (security)1:3.1+dfsg-8+deb10u8vulnerable
bullseye1:5.2+dfsg-11vulnerable
bullseye (security)1:5.2+dfsg-11+deb11u1fixed
bookworm, sid1:6.1+dfsg-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusourcestretch(not affected)
qemusourcebullseye1:5.2+dfsg-11+deb11u1DSA-4980-1
qemusource(unstable)1:6.1+dfsg-1989042

Notes

[buster] - qemu <no-dsa> (Minor issue)
[stretch] - qemu <not-affected> (The vulnerable code was introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=1958935
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01155.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01151.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01157.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01152.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01156.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01158.html
https://gitlab.com/qemu-project/qemu/-/commit/86dd8fac
https://gitlab.com/qemu-project/qemu/-/commit/b9f79858
https://gitlab.com/qemu-project/qemu/-/commit/b7afebcf
https://gitlab.com/qemu-project/qemu/-/commit/f6091d86
https://gitlab.com/qemu-project/qemu/-/commit/63736af5

Search for package or bug name: Reporting problems