CVE-2021-3682: High severity Qemu Qemu vulnerability
A flaw was found in the USB redirector device (usb-redir) of QEMU. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. More specifically, the usbredirbufferedbulkpacket() function calls bufpalloc() with an invalid pointer that points into the middle of a buffer controlled by the SPICE client. If the packet queue is full, bufpalloc() ends up freeing the same pointer passed as argument. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
Upstream issue: https://gitlab.com/qemu-project/qemu/-/issues/491
Upstream fix: https://gitlab.com/qemu-project/qemu/-/commit/5e796671e6b8d5de4b0b423dce1b3eba144a92c9
Other sources
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:6.0+dfsg-3Fixed in 1:5.2+dfsg-11+deb11u1 - Upgrade
Upgrade
redhat/qemuto a version that resolves this vulnerability.Fixed in 6.1.0 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
qemu usb-redir (usb redirector device / usbredir_buffered_bulk_packet)to a version that resolves this vulnerability.Fixed in 6.1.0-rc2Patch gitlab.com/qemu-project/qemu/-/issues/491 - Compensating control
If affected QEMU instances are exposed to untrusted SPICE clients, limit SPICE client access (e.g., only allow trusted clients/IPs) to reduce the chance of triggering the usb-redir bulk packet drop path that causes the invalid free.
Event History
Frequently Asked Questions
What is CVE-2021-3682?
CVE-2021-3682 is a vulnerability in the USB redirector device emulation of QEMU.
How severe is CVE-2021-3682?
CVE-2021-3682 has a severity score of 8.5, which is considered high.
Which software versions are affected by CVE-2021-3682?
Versions prior to 6.1.0-rc2 of QEMU are affected by CVE-2021-3682.
How can I fix CVE-2021-3682?
To fix CVE-2021-3682, update QEMU to version 6.1.0 or later.
Where can I find more information about CVE-2021-3682?
You can find more information about CVE-2021-3682 at the following references: [Link 1](https://gitlab.com/qemu-project/qemu/-/issues/491), [Link 2](https://gitlab.com/qemu-project/qemu/-/commit/5e796671e6b8d5de4b0b423dce1b3eba144a92c9), [Link 3](https://gitlab.com/qemu-project/qemu/-/commit/b2d1fe67d09d2b6c7da647fbcea6ca0148c206d3).