Description
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | qemu | up to, including qemu 4.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:5.2+dfsg-4 | — |
| Debian 13 | qemu | 1:5.2+dfsg-4 | — |
| Debian 12 | qemu | 1:5.2+dfsg-4 | — |
| Debian 10 | qemu | 1:3.1+dfsg-8+deb10u9 | DLA-3099-1 |
| Debian 9 | qemu | 1:2.8+dfsg-6+deb9u13 | DLA-2560-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | qemu | 1:4.2-3ubuntu6.17 | USN-5010-1 |
| Ubuntu 18.04 LTS | qemu | 1:2.11+dfsg-1ubuntu7.37 | USN-5010-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | qemu | 1:2.5+dfsg-5ubuntu10.51+esm4 | — |
| Ubuntu Pro 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.47+esm6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | SLOF | 20191022-3.git899d9883.module+el8.2.0+5449+efc036dd | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | hivex +6 | 1.3.18-20.module+el8.2.0+5588+63a201c3 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libguestfs-winsupport | 8.2-1.module+el8.2.0+5590+82cd80df | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libiscsi +2 | 1.18.0-8.module+el8.1.0+4066+0f1aadab | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libnbd +5 | 1.2.2-1.module+el8.2.0+5644+32ac38d4 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libnbd-bash-completion | 1.4.0-2.module+el8.3.0+7998+6ff5e5ab | RHSA-2021:1125 |
| RHEL 8 | libtpms +1 | 0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb | RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libvirt +28 | 6.0.0-25.5.module+el8.2.1+8680+ea98947b | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libvirt-dbus | 1.3.0-2.module+el8.2.0+4793+b09dd2fb | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | libvirt-python +1 | 6.0.0-1.module+el8.2.0+5453+31b2b136 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | nbdkit +13 | 1.16.2-4.module+el8.2.1+6710+effcb1df | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | nbdkit-nbd-plugin +4 | 1.22.0-2.module+el8.3.0+8203+18ecf00e | RHSA-2021:1125 |
| RHEL 8 | netcf +2 | 0.2.8-12.module+el8.1.0+4066+0f1aadab | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | perl-Sys-Virt | 6.0.0-1.module+el8.2.0+5488+267def79 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | python-pyvmomi +1 | 6.7.1-7.module+el8.2.0+4793+b09dd2fb | RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | qemu-img +10 | 15:4.2.0-29.module+el8.2.1+11280+70ae3d73.8 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | qemu-kiwi +1 | 15:5.1.0-21.module+el8.3.1+10464+8ad18d1a | RHSA-2021:1125 |
| RHEL 8 | seabios +2 | 1.13.0-2.module+el8.2.1+7284+aa32a2c4 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | sgabios +1 | 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | supermin +1 | 5.1.19-10.module+el8.2.0+4793+b09dd2fb | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | swtpm +3 | 0.2.0-2.20200127gitff5a83b.module+el8.2.0+5579+d71178e0 | RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | virglrenderer +2 | 0.8.2-1.module+el8.2.0+5777+d9c2af8c | RHSA-2021:2521 |
| RHEL 8 | virt-dib +25 | 1:1.40.2-24.module+el8.2.1+7154+47ffd890 | RHSA-2021:3061, RHSA-2021:2521, RHSA-2021:1125 |
| RHEL 8 | virt-v2v-man-pages-ja +2 | 1:1.42.0-7.module+el8.3.1+9562+c3ede7c6 | RHSA-2021:1125 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | libguestfs-winsupport | 8.2-1.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | libiscsi +2 | 1.18.0-8.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | libnbd +3 | 1.2.2-1.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | libvirt-dbus | 1.3.0-2.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | nbdkit +13 | 1.16.2-4.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | netcf +2 | 0.2.8-12.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | perl-Sys-Virt +1 | 6.0.0-1.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | seabios +2 | 1.13.0-2.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | sgabios +1 | 1:0.20170427git-3.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
| AlmaLinux 8 | supermin +1 | 5.1.19-10.module_el8.5.0+2608+72063365 | ALSA-2021:3061 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | hivex | 1.3.18-21.module+el8.4.0+642+7e26f5e1 | RLSA-2021:3061 |
| Rocky Linux 8 | libguestfs | 1:1.40.2-27.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | libguestfs-winsupport | 8.2-1.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | libiscsi | 1.18.0-8.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | libnbd | 1.2.2-1.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | libvirt | 6.0.0-35.1.module+el8.4.0+642+7e26f5e1 | RLSA-2021:3061 |
| Rocky Linux 8 | libvirt-dbus | 1.3.0-2.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | nbdkit | 1.16.2-4.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | netcf | 0.2.8-12.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | perl-Sys-Virt +1 | 6.0.0-1.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | qemu-kvm | 5:4.2.0-48.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | seabios | 1.13.0-2.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | sgabios | 1:0.20170427git-3.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
| Rocky Linux 8 | supermin | 5.1.19-10.module+el8.4.0+534+4680a14e | RLSA-2021:3061 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | qemu | 4.2.1-11.13.1 | SUSE-SU-2021:0521-1 |
| SLES 15 SP1 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
| SLES 15 | qemu | 2.11.2-9.43.1 | SUSE-SU-2021:1244-1 |
| SLES 12 SP5 | qemu | 3.1.1.1-48.2 | SUSE-SU-2021:1242-1 |
| SLES 12 SP4 | qemu | 2.11.2-5.29.1 | SUSE-SU-2021:1241-1 |
Show 20 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | qemu | 2.9.1-6.50.1 | SUSE-SU-2021:1894-1 |
| SLES 12 SP2 | qemu | 2.6.2-41.65.1 | SUSE-SU-2021:1829-1 |
| SLES 11 SP4 | kvm | 1.4.2-60.37.1 | SUSE-SU-2021:14772-1 |
| SLES for SAP 15 SP1 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
| SLES for SAP 15 | qemu | 2.11.2-9.43.1 | SUSE-SU-2021:1244-1 |
| SLES for SAP 12 SP5 | qemu | 3.1.1.1-48.2 | SUSE-SU-2021:1242-1 |
| SLES for SAP 12 SP4 | qemu | 2.11.2-5.29.1 | SUSE-SU-2021:1241-1 |
| SLES for SAP 12 SP3 | qemu | 2.9.1-6.50.1 | SUSE-SU-2021:1894-1 |
| SLE HPC 15 SP1 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
| SLE HPC 15 | qemu | 2.11.2-9.43.1 | SUSE-SU-2021:1244-1 |
| SUSE OpenStack Cloud Crowbar 9 | qemu | 2.11.2-5.29.1 | SUSE-SU-2021:1241-1 |
| SUSE OpenStack Cloud Crowbar 8 | qemu | 2.9.1-6.50.1 | SUSE-SU-2021:1894-1 |
| SUSE OpenStack Cloud 9 | qemu | 2.11.2-5.29.1 | SUSE-SU-2021:1241-1 |
| SUSE OpenStack Cloud 8 | qemu | 2.9.1-6.50.1 | SUSE-SU-2021:1894-1 |
| SUSE Manager Server 4.0 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
| SUSE Manager Retail Branch Server 4.0 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
| SUSE Manager Proxy 4.0 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | kvm | 1.4.2-53.41.1 | SUSE-SU-2021:14774-1 |
| SUSE HPE Helion OpenStack 8 | qemu | 2.9.1-6.50.1 | SUSE-SU-2021:1894-1 |
| SUSE Enterprise Storage 6 | qemu | 3.1.1.1-9.24.3 | SUSE-SU-2021:1245-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
| openSUSE Leap 15.2 | qemu | 4.2.1-lp152.9.9.2 | openSUSE-SU-2021:0363-1 |
| openSUSE Leap 15.2 | qemu-linux-user | 4.2.1-lp152.9.9.3 | openSUSE-SU-2021:0363-1 |
| openSUSE Leap 15.2 | qemu-testsuite | 4.2.1-lp152.9.9.5 | openSUSE-SU-2021:0363-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | qemu | 5.0.0-r0 | — |
| Alpine v3.23 | qemu | 5.0.0-r0 | — |
| Alpine v3.22 | qemu | 5.0.0-r0 | — |
| Alpine v3.21 | qemu | 5.0.0-r0 | — |
| Alpine v3.20 | qemu | 5.0.0-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | qemu | 5.0.0-r0 | — |
| Alpine v3.18 | qemu | 5.0.0-r0 | — |
| Alpine v3.17 | qemu | 5.0.0-r0 | — |
| Alpine v3.16 | qemu | 5.0.0-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | hivex +4 | 1.3.18-20.module+el8.4.0+20319+6eb4347c | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | libguestfs-winsupport | 8.2-1.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | libiscsi +2 | 1.18.0-8.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | libnbd +5 | 1.2.2-1.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | libvirt +29 | 5.7.0-31.module+el8.4.0+20319+6eb4347c | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | libvirt-dbus | 1.3.0-2.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | nbdkit +13 | 1.16.2-4.0.1.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | netcf +2 | 0.2.8-12.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | ocaml-hivex +1 | 1.3.18-21.module+el8.4.0+20285+126f2e4b | ELSA-2021-3061 |
| Oracle Linux 8 | ocaml-libguestfs +1 | 1:1.40.2-27.0.1.module+el8.4.0+20093+03a97712 | ELSA-2021-3061 |
| Oracle Linux 8 | perl-Sys-Virt | 4.5.0-5.module+el8.4.0+20319+6eb4347c | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | qemu-img +10 | 15:4.2.0-48.module+el8.4.0+20285+126f2e4b.3 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | seabios +2 | 1.13.0-2.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | sgabios +1 | 1:0.20170427git-3.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | supermin +1 | 5.1.19-10.module+el8.3.0+7860+a7792d29 | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 8 | virt-dib +23 | 1:1.40.2-25.0.1.module+el8.4.0+20319+6eb4347c | ELSA-2021-9568, ELSA-2021-3061 |
| Oracle Linux 7 | qemu +12 | 15:4.2.1-9.el7 | ELSA-2021-9285 |
Advisories 23
- ALSA-2021:3061 Moderate: virt:rhel and virt-devel:rhel security and bug fix update AlmaLinux Security Advisories · Nov 2, 2026
- WID-SEC-2022-1277 QEMU: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jun 29, 2026
- RHSA-2021:3061 Red Hat Security Advisory: virt:rhel and virt-devel:rhel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2021:2521 Red Hat Security Advisory: virt:8.2 and virt-devel:8.2 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2021:1125 Red Hat Security Advisory: virt:8.3 and virt-devel:8.3 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-5010-1 qemu vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3099-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2560-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2021-3061 Low: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 16, 2026
- RLSA-2021:3061 Moderate: virt:rhel and virt-devel:rhel security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2021:1894-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:14772-1 Security update for kvm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1245-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1241-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:14774-1 Security update for kvm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0363-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1242-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0521-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1244-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2021:1829-1 Security update for qemu SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2021-9568 Important: virt:kvm_utils security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 1, 2021
- ELSA-2021-9285 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 6, 2021
References
- [oss-security] 20210205 CVE-2021-20221 QEMU: aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field mailing-list
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1924601
- https://security.netapp.com/advisory/ntap-20210708-0005/
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update mailing-list