CVE-2021-3544: Medium severity Qemu Qemu vulnerability
Last updated 24 July 2024
Other sources
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
— Launchpad
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. For more information, please refer to the upstream patchset below.
Patch series: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg04536.html
Memory leak in vgresourcecreate2d() in vhost-user-gpu.c : https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg04541.html
Memory leak in vgresourceattachbacking() in vhost-user-gpu.c: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg04534.html
Memory leak in vgresourcedestroy() in vhost-user-gpu.c: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg04538.html
Memory leak in virglcmdresourceunref() in virgl.c: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg04540.html
Memory leak in virglresourceattachbacking() in virgl.c: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg04537.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
qemu/contrib/vhost-user-gpu (vhost-user-gpu device)to a version that resolves this vulnerability.Fixed in 6.0 - Upgrade
Upgrade
qemu/contrib/vhost-user-gpu/vhost-user-gpu.cto a version that resolves this vulnerability.Fixed in 6.0 - Upgrade
Upgrade
qemu/contrib/vhost-user-gpu/virgl.cto a version that resolves this vulnerability.Fixed in 6.0
Event History
Frequently Asked Questions
What is CVE-2021-3544?
CVE-2021-3544 is a vulnerability in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0, allowing memory leaks due to improper release of memory.
How severe is CVE-2021-3544?
CVE-2021-3544 has a severity score of 6.5 (high).
Which software are affected by CVE-2021-3544?
QEMU versions up to and including 6.0, Debian Linux 11.0, and various versions of QEMU on Ubuntu and Debian are affected by CVE-2021-3544.
How can I fix CVE-2021-3544?
To fix CVE-2021-3544, users should update to the latest version of QEMU or apply the relevant security patches provided by the distribution vendor.
What is the CWE category of CVE-2021-3544?
CVE-2021-3544 is categorized under CWE-401 (Memory Leak).