Skip to content
OpenAdvisories
Unscored CVE-2021-3527 EUVD-2021-26843GHSA-fwv2-775h-qv4v

A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to…

Published May 26, 2021 · Updated Aug 3, 2024 · Assigned by redhat

Package: qemu Package: qemu Package: qemu Category: Virtualization Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.

Affected products

VendorProductAffectedFixed
— QEMU all versions —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 qemu 1:5.2+dfsg-11 —
Debian 13 qemu 1:5.2+dfsg-11 —
Debian 12 qemu 1:5.2+dfsg-11 —
Debian 10 qemu 1:3.1+dfsg-8+deb10u9 DLA-3099-1
Debian 9 qemu 1:2.8+dfsg-6+deb9u15 DLA-2753-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS qemu 1:6.0+dfsg-2expubuntu1 —
Ubuntu 20.04 LTS qemu 1:4.2-3ubuntu6.17 USN-5010-1
Ubuntu 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.37 USN-5010-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS qemu 1:2.5+dfsg-5ubuntu10.51+esm4 —
Ubuntu Pro 14.04 LTS qemu 2.0.0+dfsg-2ubuntu1.47+esm6 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP3 qemu 5.2.0-103.2 SUSE-SU-2021:2858-1
SLES 15 SP2 qemu 4.2.1-11.28.1 SUSE-SU-2021:2789-1
SLES 15 SP1 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
SLES 15 qemu 2.11.2-70.59.1 SUSE-SU-2021:3613-1
SLES 12 SP5 qemu 3.1.1.1-57.2 SUSE-SU-2021:2813-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP4 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SLES 12 SP2 qemu 2.6.2-41.73.1 SUSE-SU-2021:3575-1
SLES 11 SP4 xen 4.4.4_50-61.67.1 SUSE-SU-2021:14848-1
SLES for SAP 15 SP1 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
SLES for SAP 15 qemu 2.11.2-70.59.1 SUSE-SU-2021:3613-1
SLES for SAP 12 SP5 qemu 3.1.1.1-57.2 SUSE-SU-2021:2813-1
SLES for SAP 12 SP4 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SLE Micro 5.0 qemu 4.2.1-11.28.1 SUSE-SU-2021:2789-1
SLE HPC 15 SP1 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
SLE HPC 15 qemu 2.11.2-70.59.1 SUSE-SU-2021:3613-1
SUSE OpenStack Cloud Crowbar 9 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SUSE OpenStack Cloud 9 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SUSE Enterprise Storage 6 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed qemu 6.1.0-32.1 openSUSE-SU-2024:11287-1
openSUSE Leap 15.3 qemu 3.1.1.1-80.40.1 openSUSE-SU-2021:3614-1, openSUSE-SU-2021:2858-1, openSUSE-SU-2021:2789-1
openSUSE Leap 15.2 qemu +2 4.2.1-lp152.9.20.1 openSUSE-SU-2021:1202-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 qemu 6.0.0-r2 —
Alpine v3.23 qemu 6.0.0-r2 —
Alpine v3.22 qemu 6.0.0-r2 —
Alpine v3.21 qemu 6.0.0-r2 —
Alpine v3.20 qemu 6.0.0-r2 —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 qemu 6.0.0-r2 —
Alpine v3.18 qemu 6.0.0-r2 —
Alpine v3.17 qemu 6.0.0-r2 —
Alpine v3.16 qemu 6.0.0-r2 —
Alpine v3.15 qemu 6.0.0-r2 —
Alpine v3.14 qemu 6.0.0-r2 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 qemu +26 10:3.1.0-8.amzn2.0.10 ALAS2-2023-2061

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 hivex +4 1.3.18-20.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 libguestfs-winsupport 8.2-1.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 libiscsi +2 1.18.0-8.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 libnbd +3 1.2.2-1.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 libvirt +29 5.7.0-31.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 libvirt-dbus 1.3.0-2.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 nbdkit +13 1.16.2-4.0.1.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 netcf +2 0.2.8-12.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 perl-Sys-Virt 4.5.0-5.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 qemu-img +9 15:4.2.1-11.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 seabios +2 1.13.0-2.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 sgabios +1 1:0.20170427git-3.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 supermin +1 5.1.19-10.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 8 virt-dib +23 1:1.40.2-25.0.1.module+el8.4.0+20319+6eb4347c ELSA-2021-9568
Oracle Linux 7 qemu +12 15:4.2.1-11.el7 ELSA-2021-9425

Advisories 20

References