CVE-2021-3595: Low severity Libslirp Project Libslirp vulnerability
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftpinput() function and could occur while processing a udp packet that is smaller than the size of the 'tftpt' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality.
Other sources
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The function tftpinput() handles requests for the tftp protocol from the guest. While processing a udp packet that is smaller than the size of the tftpt structure it uses memory from outside the working mbuf buffer. This issue may lead to out of bound read access or indirect memory disclosure to the guest.
Upstream commits: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e7 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3f179481 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/990163cf
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libslirpto a version that resolves this vulnerability.Fixed in 4.6.0 - Upgrade
Upgrade
debian/libslirpto a version that resolves this vulnerability.Fixed in 4.4.0-1+deb11u2Fixed in 4.7.0-1Fixed in 4.8.0-1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
libslirpto a version that resolves this vulnerability.Fixed in 4.6.0Patch commit/3f179481 - Upgrade
Upgrade
libslirpto a version that resolves this vulnerability.Fixed in 4.6.0Patch commit/93e645e7 - Upgrade
Upgrade
libslirpto a version that resolves this vulnerability.Fixed in 4.6.0Patch commit/990163cf
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-3595.
What is the severity of CVE-2021-3595?
CVE-2021-3595 has a severity level of 3.8 (low).
Which software is affected by CVE-2021-3595?
The affected software includes libslirp versions up to and including 4.6.0, Red Hat Enterprise Linux 8.0, Debian Debian Linux 9.0, Fedora 33 and 34.
How can I fix CVE-2021-3595?
To fix CVE-2021-3595, it is recommended to update to libslirp version 4.6.1 or newer.
Where can I find more information about CVE-2021-3595?
More information about CVE-2021-3595 can be found at the following references: [link1](https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e7), [link2](https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3f179481), [link3](https://gitlab.freedesktop.org/slirp/libslirp/-/commit/990163cf).