CVE-2021-3638: Medium severity Qemu Qemu vulnerability
A flaw was found in the ATI VGA emulation of QEMU. An inconsistent check and use of dst[x|y] and s->regs.dst[x|y] may lead to out-of-bounds write of vramptr. This flaw occurs in the ati2dblt() routine while handling MMIO write operations from the guest. A malicious guest user could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Note: this is similar to CVE-2020-11869, CVE-2020-24352 and CVE-2020-27616.
Other sources
An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati2dblt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-3638?
CVE-2021-3638 is an out-of-bounds memory access vulnerability in the ATI VGA device emulation of QEMU.
What is the severity of CVE-2021-3638?
The severity of CVE-2021-3638 is high with a severity value of 6.5.
Which software is affected by CVE-2021-3638?
QEMU versions between 4.0.0 and 6.1.0, Fedora 36, Fedora 37, and Debian QEMU versions mentioned in the references are affected.
How does CVE-2021-3638 impact QEMU?
CVE-2021-3638 can allow a malicious guest to crash QEMU by exploiting the out-of-bounds memory access flaw.
Is there a fix for CVE-2021-3638?
Yes, updating to the fixed versions mentioned in the references will address the vulnerability.