CVE-2021-3544

NameCVE-2021-3544
DescriptionSeveral memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4980-1
Debian Bugs989042

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)bullseye1:5.2+dfsg-11+deb11u3fixed
bullseye (security)1:5.2+dfsg-11+deb11u2fixed
bookworm1:7.2+dfsg-7+deb12u7fixed
sid, trixie1:9.1.1+ds-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusourcestretch(not affected)
qemusourcebuster(not affected)
qemusourcebullseye1:5.2+dfsg-11+deb11u1DSA-4980-1
qemusource(unstable)1:6.1+dfsg-1989042

Notes

[buster] - qemu <not-affected> (Only minimal support present and not installed in binary packages)
[stretch] - qemu <not-affected> (The vulnerable code was introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=1958935
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01155.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01151.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01157.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01152.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01156.html
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01158.html
https://gitlab.com/qemu-project/qemu/-/commit/86dd8fac
https://gitlab.com/qemu-project/qemu/-/commit/b9f79858
https://gitlab.com/qemu-project/qemu/-/commit/b7afebcf
https://gitlab.com/qemu-project/qemu/-/commit/f6091d86
https://gitlab.com/qemu-project/qemu/-/commit/63736af5

Search for package or bug name: Reporting problems