CVE-2021-3608: Medium severity qemu vulnerability
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMAREGDSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.
Other sources
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The flaw exists in the pvrdmaringinit() function in hw/rdma/vmw/pvrdmadevring.c and could occur while handling a "PVRDMAREGDSRHIGH" write from the guest. Due to improper initialization of the 'ring->pages' array, rdmapcidmaunmap() may be passed an uninitialized pointer as argument, leading to undefined behavior and possible crash of the QEMU process on the host.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw in the QEMU implementation of VMWare paravirtual RDMA device?
The vulnerability ID is CVE-2021-3608.
What is the severity level of CVE-2021-3608?
The severity level of CVE-2021-3608 is medium.
Which software versions are affected by CVE-2021-3608?
Software versions prior to 6.1.0 of QEMU, Debian Linux 10.0, and Fedora 34 are affected by CVE-2021-3608.
How can I fix the vulnerability CVE-2021-3608?
To fix CVE-2021-3608, update QEMU to version 6.1.0 or higher and apply any available patches from the respective vendors.
Where can I find more information about CVE-2021-3608?
You can find more information about CVE-2021-3608 in the references provided: [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=1973383), [QEMU Devel Mailing List](https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07926.html), [NetApp Security Advisory](https://security.netapp.com/advisory/ntap-20220318-0002/).