CVE-2021-3713

Name	CVE-2021-3713
Description	An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2753-1, DLA-3099-1, DSA-4980-1
Debian Bugs	992727

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	buster	1:3.1+dfsg-8+deb10u8	vulnerable
	buster (security)	1:3.1+dfsg-8+deb10u12	fixed
	bullseye	1:5.2+dfsg-11+deb11u3	fixed
	bullseye (security)	1:5.2+dfsg-11+deb11u2	fixed
	bookworm	1:7.2+dfsg-7+deb12u5	fixed
	trixie	1:8.2.1+ds-2	fixed
	sid	1:8.2.2+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
qemu	source	stretch	1:2.8+dfsg-6+deb9u15	DLA-2753-1
qemu	source	buster	1:3.1+dfsg-8+deb10u9	DLA-3099-1
qemu	source	bullseye	1:5.2+dfsg-11+deb11u1	DSA-4980-1
qemu	source	(unstable)	1:6.1+dfsg-2		992727

https://bugzilla.redhat.com/show_bug.cgi?id=1994640
https://gitlab.com/qemu-project/qemu/-/commit/13b250b12ad3c59114a6a17d59caf073ce45b33a