CVE-2021-4158: Null Pointer Dereference
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Other sources
A NULL pointer dereference was found in the ACPI code of QEMU. The flaw lies in hw/acpi/pcihp.c in pciwrite() where the bus pointer is used without checking if it's NULL, probably because an invalid selector was supplied. A malicious privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Upstream issue: https://gitlab.com/qemu-project/qemu/-/issues/770
Upstream patch: https://lists.nongnu.org/archive/html/qemu-devel/2021-12/msg01491.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 17:7.0.0-13.el9 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 7.0.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-4158.
What is the severity of CVE-2021-4158?
The severity of CVE-2021-4158 is medium.
What is the affected software for CVE-2021-4158?
The affected software for CVE-2021-4158 includes Red Hat Enterprise Linux 9.0, qemu-kvm 17:7.0.0-13.el9, Ubuntu qemu 1:6.2+dfsg-2ubuntu5, and Ubuntu qemu 1:6.0+dfsg-2.
How can a malicious user exploit CVE-2021-4158?
A malicious, privileged user within the guest can exploit CVE-2021-4158 to crash the QEMU process on the host, resulting in a denial of service condition.
Is there a remedy available for CVE-2021-4158?
Yes, there are remedies available for CVE-2021-4158. Please refer to the official documentation and updates provided by your software vendor for the specific package versions mentioned.