CVE-2021-3735: Medium severity qemu vulnerability
A deadlock issue was found in the AHCI controller device (ich9-ahci) of QEMU while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. The bug is triggered on a software reset (ahciresetport) in the handleregh2dfis() function [1]. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition.
[1] https://github.com/qemu/qemu/blob/v6.1.0-rc4/hw/ide/ahci.c#L1215
Other sources
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahciresetport) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-3735?
CVE-2021-3735 is a deadlock issue found in the AHCI controller device of QEMU.
How does CVE-2021-3735 occur?
CVE-2021-3735 occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS packet from the guest.
Who is affected by CVE-2021-3735?
Users of QEMU versions 1:3.1+dfsg-8+deb10u8 to 1:3.1+dfsg-8+deb10u11, 1:5.2+dfsg-11+deb11u3 to 1:5.2+dfsg-11+deb11u2, 1:7.2+dfsg-7+deb12u2, 1:8.1.1+ds-2, and 1:8.1.2+ds-1, as well as QEMU version 6.1.0-rc4 and Debian Linux versions 10.0 and 11.0 are affected by CVE-2021-3735.
What is the severity of CVE-2021-3735?
CVE-2021-3735 has a severity score of 4.4 out of 10, which is considered medium.
How can I fix CVE-2021-3735?
There is currently no known fix for CVE-2021-3735. It is recommended to update to a patched version of QEMU when it becomes available.