CVE-2021-3409

Name
CVE-2021-3409
Description
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Mailing List https://www.openwall.com/lists/oss-security/2021/03/09/1
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1928146
MLIST https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html
CONFIRM https://security.netapp.com/advisory/ntap-20210507-0001/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* qemu >= None <= 5.2.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
qemu 3.13-community 5.2.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
qemu 3.10-main 4.0.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable