CVE-2021-3594

Name
CVE-2021-3594
Description
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
NVD Severity
low
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://bugzilla.redhat.com/show_bug.cgi?id=1970491
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/
Third Party Advisory https://security.gentoo.org/glsa/202107-44
Third Party Advisory https://security.netapp.com/advisory/ntap-20210805-0004/
Mailing List https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libslirp_project:libslirp:*:*:*:*:*:*:*:* libslirp >= None < 4.6.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libslirp edge-community 4.6.0-r0 Michał Polański <michal@polanski.me> fixed
libslirp edge-community 4.4.0-r0 Michał Polański <michal@polanski.me> possibly vulnerable
libslirp edge-community 4.3.1-r0 None possibly vulnerable
libslirp edge-community 4.3.0-r0 None possibly vulnerable
libslirp 3.22-community 4.6.0-r0 None fixed
libslirp 3.22-community 4.4.0-r0 None possibly vulnerable
libslirp 3.22-community 4.3.1-r0 None possibly vulnerable
libslirp 3.22-community 4.3.0-r0 None possibly vulnerable
libslirp 3.21-community 4.6.0-r0 None fixed
libslirp 3.20-community 4.6.0-r0 None fixed
libslirp 3.19-community 4.6.0-r0 None fixed
libslirp 3.18-community 4.6.0-r0 None fixed
libslirp 3.17-community 4.6.0-r0 None fixed