CVE-2021-3592: Low severity Libslirp Project Libslirp vulnerability
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootpinput() function and could occur while processing a udp packet that is smaller than the size of the 'bootpt' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality.
Other sources
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The function bootpinput() in src/bootp.c handles requests for the bootp protocol from the guest. While processing a udp packet that is smaller than the size of the bootpt structure (548 bytes) it uses memory from outside the working mbuf buffer. This may lead to the leakage of 10 bytes of uninitialized heap memory to the guest.
Upstream commits: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e7 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/f13cad45 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2eca0838
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libslirpto a version that resolves this vulnerability.Fixed in 4.6.0 - Upgrade
Upgrade
debian/libslirpto a version that resolves this vulnerability.Fixed in 4.4.0-1+deb11u2Fixed in 4.7.0-1Fixed in 4.8.0-1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u4Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc3+ds-2Fixed in 1:10.0.0+ds-1 - Upgrade
Upgrade
libslirpto a version that resolves this vulnerability.Fixed in 4.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2eca0838 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 93e645e7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch f13cad45
Event History
Frequently Asked Questions
What is CVE-2021-3592?
CVE-2021-3592 is an invalid pointer initialization issue found in the SLiRP networking implementation of QEMU.
How does CVE-2021-3592 occur?
CVE-2021-3592 occurs in the bootp_input() function while processing a udp packet that is smaller than the size of the 'bootp_t' structure.
What is the severity of CVE-2021-3592?
CVE-2021-3592 has a severity value of 3.8 (low).
Which software is affected by CVE-2021-3592?
The affected software includes libslirp, Redhat Enterprise Linux, Debian Linux, and Fedora.
How can I fix CVE-2021-3592?
You can fix CVE-2021-3592 by applying the recommended updates or patches provided by the software vendors.