CVE-2021-3748: Use After Free
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
Other sources
OSS-Fuzz found a use-after-free vulnerability in virtio-net. It occurs in the virtionetreceivercu function (hw/net/virtio-net.c) under these conditions:
1) the (malicious) driver tries to add a non direct memory region as the buffer address 2) then memory core needs to use the bounce buffer 3) virtio-net tries to set the numbuffers after the iov is unmapped (bounce buffer is freed)
A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
Upstream patch & commit: https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.html https://gitlab.com/qemu-project/qemu/-/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.7+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:10.2.1+ds-1 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 6.2.0 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u5 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u18 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u15 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:10.0.7+ds-0+deb13u1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:10.0.2+ds-2+deb13u1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:10.2.1+ds-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch bedd7e93d01961fcb16a97ae45d93acf357e11f6
Event History
Frequently Asked Questions
What is the vulnerability ID for this use-after-free vulnerability?
The vulnerability ID for this use-after-free vulnerability is CVE-2021-3748.
What is the severity level of CVE-2021-3748?
The severity level of CVE-2021-3748 is high with a severity value of 7.5.
Which software is affected by CVE-2021-3748?
The affected software includes QEMU, qemu-kvm, Debian Linux, Ubuntu Linux, Fedora, and Red Hat Enterprise Linux.
How can a malicious guest exploit CVE-2021-3748?
A malicious guest can exploit CVE-2021-3748 to crash QEMU by causing a use-after-free vulnerability in the virtio-net device.
Where can I find more information about CVE-2021-3748?
You can find more information about CVE-2021-3748 on the QEMU mailing list and GitLab repositories.