CVE-2021-3713: High severity Qemu Qemu vulnerability
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
Other sources
An out-of-bounds write issue was found in the UAS (USB Attached SCSI) device emulation of QEMU. It occurs due to missing sanity checks in the usbuashandledata() function in hw/usb/dev-uas.c. In particular, the device uses the guest-supplied stream number unchecked, which can lead to guest-triggered out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields.
Upstream fix: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg02766.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemuto a version that resolves this vulnerability.Fixed in 6.2.0 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
qemuto a version that resolves this vulnerability.Fixed in 6.2.0-rc0 - Compensating control
If upgrading is not immediately possible, isolate/contain QEMU workloads to reduce impact from a malicious guest (e.g., run QEMU in a sandbox/VM or with strong host isolation), since the flaw can crash QEMU or potentially lead to code execution with the privileges of the QEMU process on the host.
Event History
Frequently Asked Questions
What is CVE-2021-3713?
CVE-2021-3713 is an out-of-bounds write flaw found in the UAS (USB Attached SCSI) device emulation of QEMU.
What is the severity of CVE-2021-3713?
The severity of CVE-2021-3713 is high (CVSS score 7.4).
Which software versions are affected by CVE-2021-3713?
QEMU versions prior to 6.2.0-rc0 and Debian Linux versions 9.0, 10.0, and 11.0 are affected.
How can this vulnerability be exploited?
This vulnerability can be exploited by a malicious guest using the guest supplied stream number unchecked.
Are there any references for CVE-2021-3713?
Yes, you can find references for CVE-2021-3713 at the following links: [link1](https://security-tracker.debian.org/tracker/CVE-2021-3713), [link2](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3713), [link3](https://bugzilla.redhat.com/show_bug.cgi?id=1994640).