Skip to content
OpenAdvisories
Unscored CVE-2021-3748 EUVD-2021-27024GHSA-4f87-mww8-gm8x

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non …

Published Mar 23, 2022 · Updated Aug 3, 2024 · Assigned by redhat

Description

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

Affected products

VendorProductAffectedFixed
— QEMU (virtio-net) Affects qemu v0.10.0 and above, Fixed In – v6.2.0-rc0 and above. —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 qemu 1:6.1+dfsg-6 —
Debian 13 qemu 1:6.1+dfsg-6 —
Debian 12 qemu 1:6.1+dfsg-6 —
Debian 11 qemu 1:5.2+dfsg-11+deb11u1 DSA-4980-1
Debian 10 qemu 1:3.1+dfsg-8+deb10u9 DLA-3099-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 9 qemu 1:2.8+dfsg-6+deb9u17 DLA-2970-1
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS qemu 1:6.2+dfsg-2ubuntu5 —
Ubuntu 20.04 LTS qemu 1:4.2-3ubuntu6.21 USN-5307-1
Ubuntu 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.39 USN-5307-1
ReleasePackageFixed inAdvisory
RHEL 8 SLOF 20191022-3.git899d9883.module+el8.2.0+5449+efc036dd RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 hivex +6 1.3.18-20.module+el8.2.0+5588+63a201c3 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libguestfs-appliance 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2022:1759
RHEL 8 libguestfs-winsupport 8.2-2.module+el8.2.1+12663+d52ebc0d RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libiscsi +2 1.18.0-8.module+el8.2.0+4793+b09dd2fb RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libnbd +5 1.2.2-1.module+el8.2.0+5644+32ac38d4 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libnbd-bash-completion 1.6.0-3.module+el8.4.0+9856+bbc47853 RHSA-2022:1759, RHSA-2021:4112
RHEL 8 libtpms +1 0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libvirt +28 6.0.0-25.6.module+el8.2.1+12457+868e9540 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libvirt-dbus 1.3.0-2.module+el8.2.0+4793+b09dd2fb RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libvirt-python +1 6.0.0-1.module+el8.2.0+5453+31b2b136 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 libvirt-wireshark 7.0.0-14.5.module+el8.4.0+13026+f38c77ab RHSA-2022:1759, RHSA-2021:4112
RHEL 8 nbdkit +13 1.16.2-4.module+el8.2.1+6710+effcb1df RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 nbdkit-nbd-plugin +4 1.24.0-1.module+el8.4.0+9341+96cf2672 RHSA-2022:1759, RHSA-2021:4112
RHEL 8 netcf +2 0.2.8-12.module+el8.2.0+4793+b09dd2fb RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 perl-Sys-Virt 6.0.0-1.module+el8.2.0+5488+267def79 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 python-pyvmomi +1 6.7.1-7.module+el8.2.0+4793+b09dd2fb RHSA-2021:5036, RHSA-2021:4112
RHEL 8 qemu-img +10 15:4.2.0-29.module+el8.2.1+13346+415e44e8.10 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 qemu-kiwi +3 15:5.2.0-16.module+el8.4.0+13043+9eb47245.11 RHSA-2022:1759, RHSA-2021:4112
RHEL 8 qemu-kvm-hw-usbredir 15:6.2.0-11.module+el8.6.0+14707+5aa4b42d RHSA-2022:1759
RHEL 8 seabios +2 1.13.0-2.module+el8.2.1+7284+aa32a2c4 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 sgabios +1 1:0.20170427git-3.module+el8.2.0+4793+b09dd2fb RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 supermin +1 5.1.19-10.module+el8.2.0+4793+b09dd2fb RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 swtpm +3 0.2.0-2.20200127gitff5a83b.module+el8.2.0+5579+d71178e0 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 swtpm-tools-pkcs11 0.7.0-1.20211109gitb79fd91.module+el8.6.0+14480+c0a3aa0f RHSA-2022:1759
RHEL 8 virglrenderer +2 0.8.2-1.module+el8.2.0+5777+d9c2af8c RHSA-2021:5036
RHEL 8 virt-dib +25 1:1.40.2-24.module+el8.2.1+7154+47ffd890 RHSA-2022:1759, RHSA-2021:5036, RHSA-2021:4112
RHEL 8 virt-v2v-man-pages-ja +2 1:1.42.0-9.module+el8.4.0+9561+069bb9c1 RHSA-2022:1759, RHSA-2021:4112

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 SLOF 20210217-1.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 hivex +6 1.3.18-23.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 libguestfs-winsupport 8.6-1.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 libiscsi +2 1.18.0-8.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 libnbd +6 1.6.0-5.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 libtpms +1 0.9.1-0.20211126git1ff6fe1f43.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 libvirt +27 8.0.0-5.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 libvirt-dbus 1.3.0-2.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 nbdkit +18 1.24.0-4.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 netcf +2 0.2.8-12.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 perl-Sys-Virt +1 8.0.0-1.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 qemu-img +14 15:6.2.0-11.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 seabios +2 1.15.0-2.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 sgabios +1 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 supermin +1 5.2.1-1.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 swtpm +4 0.7.0-1.20211109gitb79fd91.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759
AlmaLinux 8 virt-dib +24 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma ALSA-2022:1759
AlmaLinux 8 virt-v2v +3 1:1.42.0-18.module_el8.6.0+2880+7d9e3703 ALSA-2022:1759

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 hivex 1.3.18-23.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 libguestfs 1:1.44.0-5.module+el8.6.0+1052+ff61d164.rocky RLSA-2022:1759
Rocky Linux 8 libguestfs-winsupport 8.6-1.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 libiscsi 1.18.0-8.module+el8.4.0+534+4680a14e RLSA-2022:1759
Rocky Linux 8 libnbd 1.6.0-5.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 libtpms 0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+1052+ff61d164 RLSA-2022:1759
Rocky Linux 8 libvirt 8.0.0-5.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 libvirt-dbus 1.3.0-2.module+el8.4.0+534+4680a14e RLSA-2022:1759
Rocky Linux 8 nbdkit 1.24.0-4.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 netcf 0.2.8-12.module+el8.4.0+534+4680a14e RLSA-2022:1759
Rocky Linux 8 perl-Sys-Virt +1 8.0.0-1.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 qemu-kvm 5:6.2.0-11.module+el8.6.0+1000+18e3b59f.5 RLSA-2022:1759
Rocky Linux 8 seabios 1.15.0-2.module+el8.6.0+1052+ff61d164 RLSA-2022:1759
Rocky Linux 8 sgabios 1:0.20170427git-3.module+el8.4.0+534+4680a14e RLSA-2022:1759
Rocky Linux 8 supermin 5.2.1-1.module+el8.6.0+1052+ff61d164 RLSA-2022:1759
Rocky Linux 8 swtpm 0.7.0-1.20211109gitb79fd91.module+el8.6.0+847+b490afdd RLSA-2022:1759
Rocky Linux 8 virt-v2v 1:1.42.0-18.module+el8.6.0+847+b490afdd RLSA-2022:1759
ReleasePackageFixed inAdvisory
SLES 15 SP3 qemu 5.2.0-106.4 SUSE-SU-2021:3605-1
SLES 15 SP2 qemu 4.2.1-11.31.3 SUSE-SU-2021:3604-1
SLES 15 SP1 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
SLES 15 qemu 2.11.2-70.59.1 SUSE-SU-2021:3613-1
SLES 12 SP5 qemu 3.1.1.1-60.2 SUSE-SU-2021:3519-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP4 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SLES 12 SP3 qemu 2.9.1-43.62.1 SUSE-SU-2021:3653-1
SLES for SAP 15 SP1 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
SLES for SAP 15 qemu 2.11.2-70.59.1 SUSE-SU-2021:3613-1
SLES for SAP 12 SP5 qemu 3.1.1.1-60.2 SUSE-SU-2021:3519-1
SLES for SAP 12 SP4 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SLES for SAP 12 SP3 qemu 2.9.1-43.62.1 SUSE-SU-2021:3653-1
SLE Micro 5.1 qemu 5.2.0-106.4 SUSE-SU-2021:3605-1
SLE Micro 5.0 qemu 4.2.1-11.31.3 SUSE-SU-2021:3604-1
SLE HPC 15 SP1 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
SLE HPC 15 qemu 2.11.2-70.59.1 SUSE-SU-2021:3613-1
SUSE OpenStack Cloud Crowbar 9 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SUSE OpenStack Cloud Crowbar 8 qemu 2.9.1-43.62.1 SUSE-SU-2021:3653-1
SUSE OpenStack Cloud 9 qemu 2.11.2-5.40.2 SUSE-SU-2021:3635-1
SUSE OpenStack Cloud 8 qemu 2.9.1-43.62.1 SUSE-SU-2021:3653-1
SUSE HPE Helion OpenStack 8 qemu 2.9.1-43.62.1 SUSE-SU-2021:3653-1
SUSE Enterprise Storage 6 qemu 3.1.1.1-80.40.1 SUSE-SU-2021:3614-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed qemu 6.1.0-34.1 openSUSE-SU-2024:11597-1
openSUSE Leap 15.3 qemu 3.1.1.1-80.40.1 openSUSE-SU-2021:3614-1, openSUSE-SU-2021:3605-1, openSUSE-SU-2021:3604-1
openSUSE Leap 15.3 qemu-testsuite +1 5.2.0-106.3 openSUSE-SU-2021:3605-1
openSUSE Leap 15.2 qemu +2 4.2.1-lp152.9.23.1 openSUSE-SU-2021:1461-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) qemu 6.2.0-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 hivex +4 1.3.18-21.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 libguestfs-winsupport 8.2-1.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 libiscsi +2 1.18.0-8.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 libnbd +3 1.2.2-1.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 libtpms +1 0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 libvirt +29 5.7.0-33.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 libvirt-dbus 1.3.0-2.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 libvirt-wireshark 8.0.0-5.0.1.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 nbdkit +13 1.16.2-4.0.1.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 nbdkit-nbd-plugin +4 1.24.0-4.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 netcf +2 0.2.8-12.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 ocaml-hivex +1 1.3.18-23.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 ocaml-libguestfs +2 1:1.44.0-5.0.1.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 ocaml-libnbd +2 1.6.0-5.module+el8.6.0+20664+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 olcne-metallb-chart +1 1.5.3-1.el8 ELSA-2022-9493
Oracle Linux 8 olcnectl +10 1.4.5-1.el8 ELSA-2022-9494, ELSA-2022-9493
Oracle Linux 8 perl-Sys-Virt 4.5.0-5.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 qemu-img +9 15:4.2.1-17.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 qemu-kvm-docs +4 15:6.2.0-11.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 seabios +2 1.13.0-2.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 sgabios +1 1:0.20170427git-3.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 supermin +1 5.1.19-10.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 swtpm +4 0.7.0-1.20211109gitb79fd91.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 8 virt-dib +23 1:1.40.2-28.0.4.module+el8.5.0+20645+1693a26d ELSA-2022-9460, ELSA-2022-1759
Oracle Linux 8 virt-v2v-man-pages-ja +2 1:1.42.0-18.0.1.module+el8.6.0+20659+3dcf7c70 ELSA-2022-1759
Oracle Linux 7 olcne-metallb-chart +1 1.5.3-1.el7 ELSA-2022-9491
Oracle Linux 7 olcnectl +10 1.4.5-1.el7 ELSA-2022-9492, ELSA-2022-9491
Oracle Linux 7 qemu +12 15:4.2.1-17.el7 ELSA-2022-9432

Advisories 29

References