CVE-2021-3592

Name
CVE-2021-3592
Description
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
NVD Severity
low
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://bugzilla.redhat.com/show_bug.cgi?id=1970484
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/
Third Party Advisory https://security.gentoo.org/glsa/202107-44
Third Party Advisory https://security.netapp.com/advisory/ntap-20210805-0004/
Mailing List https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html
Third Party Advisory https://lists.debian.org/debian-lts-announce/2021/09/msg00004.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libslirp_project:libslirp:*:*:*:*:*:*:*:* libslirp >= None < 4.6.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libslirp edge-community 4.6.0-r0 Michał Polański <michal@polanski.me> fixed
libslirp edge-community 4.4.0-r0 Michał Polański <michal@polanski.me> possibly vulnerable
libslirp edge-community 4.3.1-r0 None possibly vulnerable
libslirp edge-community 4.3.0-r0 None possibly vulnerable
libslirp 3.22-community 4.6.0-r0 None fixed
libslirp 3.22-community 4.4.0-r0 None possibly vulnerable
libslirp 3.22-community 4.3.1-r0 None possibly vulnerable
libslirp 3.22-community 4.3.0-r0 None possibly vulnerable
libslirp 3.21-community 4.6.0-r0 None fixed
libslirp 3.20-community 4.6.0-r0 None fixed
libslirp 3.19-community 4.6.0-r0 None fixed
libslirp 3.18-community 4.6.0-r0 None fixed
libslirp 3.17-community 4.6.0-r0 None fixed