CVE-2021-3527: Medium severity Qemu Qemu vulnerability
A flaw was found in the USB redirection support (usb-redir) of QEMU. More specifically, usb-host and usb-redirect try to batch bulk transfers by combining many small USB packets into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk sending is used in usbredirhandlebulkdata() to dynamically allocate a variable length array (VLA) on the stack. Since the total size is not bounded, a malicious guest could be able to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
Other sources
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2
Event History
Frequently Asked Questions
What is CVE-2021-3527?
CVE-2021-3527 is a vulnerability in the USB redirector device (usb-redir) of QEMU.
How does CVE-2021-3527 affect QEMU?
CVE-2021-3527 allows an attacker to cause a stack-based buffer overflow in QEMU.
What is the severity of CVE-2021-3527?
CVE-2021-3527 has a severity rating of 5.5 (Medium).
Which software versions are affected by CVE-2021-3527?
QEMU version 6.0.0 and Red Hat Enterprise Linux 8.0 are affected by CVE-2021-3527.
How can I fix CVE-2021-3527?
To fix CVE-2021-3527, update QEMU to version 6.0.0 or apply the recommended patches for affected software.