CVE-2021-3638
First published: Wed Jul 07 2021(Updated: )
A flaw was found in the ATI VGA emulation of QEMU. An inconsistent check and use of dst_[x|y] and s->regs.dst_[x|y] may lead to out-of-bounds write of vram_ptr. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations from the guest. A malicious guest user could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Note: this is similar to <a href="https://access.redhat.com/security/cve/CVE-2020-11869">CVE-2020-11869</a>, <a href="https://access.redhat.com/security/cve/CVE-2020-24352">CVE-2020-24352</a> and <a href="https://access.redhat.com/security/cve/CVE-2020-27616">CVE-2020-27616</a>.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU qemu | >=4.0.0<=6.1.0 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| ubuntu/qemu | <1:4.2-3ubuntu6.28 | 1:4.2-3ubuntu6.28 |
| debian/qemu | 1:3.1+dfsg-8+deb10u8 1:3.1+dfsg-8+deb10u11 1:5.2+dfsg-11+deb11u3 1:5.2+dfsg-11+deb11u2 1:7.2+dfsg-7+deb12u3 1:8.2.1+ds-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2021-3638
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3638
- https://bugzilla.redhat.com/show_bug.cgi?id=1979858
- https://security-tracker.debian.org/tracker/CVE-2021-3748
- https://security-tracker.debian.org/tracker/CVE-2021-3682
- https://security-tracker.debian.org/tracker/CVE-2021-3713
- https://security-tracker.debian.org/tracker/CVE-2021-3544
- https://security-tracker.debian.org/tracker/CVE-2021-3545
- https://security-tracker.debian.org/tracker/CVE-2021-3546
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992726
- https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html
- https://ubuntu.com/security/CVE-2021-3638
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTVPHLLXJ65BUMFBUUZ35F3J632SLFRK/
- https://security.netapp.com/advisory/ntap-20220407-0003/
- https://launchpad.net/bugs/cve/CVE-2021-3638
- https://access.redhat.com/security/cve/CVE-2020-11869
- https://access.redhat.com/security/cve/CVE-2020-24352
- https://access.redhat.com/security/cve/CVE-2020-27616
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1979882
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1979858#c4
- https://access.redhat.com/security/cve/CVE-2021-3638
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1894036#c0
- https://gitlab.com/qemu-project/qemu/-/commit/205ccfd7a5ec86bd9a5678b8bd157562fc9a1643
- https://lore.kernel.org/qemu-devel/CAA8xKjXkDwPYxSAeRb+2mfHRrbiL_kh9unVkemFXLfF68UXePA@mail.gmail.com
- https://gitlab.com/qemu-project/qemu/-/commit/584acf34cb05f16e13a46d666196a7583d232616
- https://ubuntu.com/security/notices/USN-6567-1
- https://nvd.nist.gov/vuln/detail/CVE-2021-3638
Frequently Asked Questions
What is CVE-2021-3638?
CVE-2021-3638 is an out-of-bounds memory access vulnerability in the ATI VGA device emulation of QEMU.
What is the severity of CVE-2021-3638?
The severity of CVE-2021-3638 is high with a severity value of 6.5.
Which software is affected by CVE-2021-3638?
QEMU versions between 4.0.0 and 6.1.0, Fedora 36, Fedora 37, and Debian QEMU versions mentioned in the references are affected.
How does CVE-2021-3638 impact QEMU?
CVE-2021-3638 can allow a malicious guest to crash QEMU by exploiting the out-of-bounds memory access flaw.
Is there a fix for CVE-2021-3638?
Yes, updating to the fixed versions mentioned in the references will address the vulnerability.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/debian-bugs
- alias/CVE-2021-3638
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- vendor/qemu
- canonical/qemu qemu
- version/qemu qemu/4.0.0
- version/qemu qemu/6.1.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37
- package-manager/debian
- package-manager/ubuntu