CVE-2021-3416: Medium severity Qemu Qemu vulnerability
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
Other sources
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU. The said issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume cpu cycles or crash the QEMU process on the host resulting in DoS scenario.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07431.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:9.2.2+ds-1Fixed in 1:10.0.0~rc2+ds-2
Event History
Frequently Asked Questions
What is CVE-2021-3416?
CVE-2021-3416 is a potential stack overflow via infinite loop issue found in various NIC emulators of QEMU.
What is the severity of CVE-2021-3416?
CVE-2021-3416 has a severity level of medium.
Which versions of QEMU are affected by CVE-2021-3416?
Versions up to and including 5.2.0 of QEMU are affected by CVE-2021-3416.
How can CVE-2021-3416 be exploited?
A guest user/process can exploit CVE-2021-3416 to consume CPU cycles or crash the QEMU process.
Are there any remedies available for CVE-2021-3416?
Yes, there are remedies available for CVE-2021-3416. Please refer to the relevant links for more information.