Skip to content
OpenAdvisories
Unscored CVE-2021-3750 EUVD-2021-27025GHSA-2v3x-7c37-r5r2

A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its…

Published May 2, 2022 · Updated Aug 3, 2024 · Assigned by redhat

Description

A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.

Affected products

VendorProductAffectedFixed
— QEMU QEMU before version 7.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 qemu 1:7.0+dfsg-1 —
Debian 13 qemu 1:7.0+dfsg-1 —
Debian 12 qemu 1:7.0+dfsg-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS qemu 1:6.2+dfsg-2ubuntu6.6 USN-5772-1
Ubuntu 20.04 LTS qemu 1:4.2-3ubuntu6.24 USN-5772-1
Ubuntu 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.41 USN-5772-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS qemu 1:2.5+dfsg-5ubuntu10.51+esm1 USN-5772-1
Ubuntu Pro 14.04 LTS qemu 2.0.0+dfsg-2ubuntu1.47+esm2 USN-5772-1
ReleasePackageFixed inAdvisory
RHEL 9 qemu-img +21 17:7.0.0-13.el9 RHSA-2022:7967
RHEL 8 SLOF 20210217-1.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 hivex +6 1.3.18-23.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 libguestfs-winsupport 8.9-1.module+el8.9.0+19846+58c50e4e RHSA-2023:6980
RHEL 8 libiscsi +2 1.18.0-8.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 libnbd +6 1.6.0-5.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 libvirt +27 8.0.0-22.module+el8.9.0+19544+b3045133 RHSA-2023:6980
RHEL 8 libvirt-dbus 1.3.0-2.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 libvirt-python +1 8.0.0-2.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 nbdkit +18 1.24.0-5.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 netcf +2 0.2.8-12.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 perl-Sys-Virt 8.0.0-1.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 qemu-img +14 15:6.2.0-40.module+el8.9.0+20056+d9fb1ac3.1 RHSA-2023:6980
RHEL 8 seabios +2 1.16.0-4.module+el8.9.0+19570+14a90618 RHSA-2023:6980
RHEL 8 sgabios +1 1:0.20170427git-3.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 supermin +1 5.2.1-2.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 swtpm +4 0.7.0-4.20211109gitb79fd91.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 virt-dib +24 1:1.44.0-9.module+el8.9.0+18724+20190c23 RHSA-2023:6980
RHEL 8 virt-v2v +3 1:1.42.0-22.module+el8.9.0+18724+20190c23 RHSA-2023:6980
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 EUS SLOF 20210217-2.module+el8.8.0+20737+daad9f3b RHSA-2024:0569
RHEL 8.8 EUS hivex +6 1.3.18-23.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS libguestfs-winsupport 8.8-2.module+el8.8.0+19817+dd5e62f6 RHSA-2024:0569
RHEL 8.8 EUS libiscsi +2 1.18.0-8.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS libnbd +6 1.6.0-5.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module+el8.8.0+18453+1482ba89 RHSA-2024:0569
RHEL 8.8 EUS libvirt +27 8.0.0-19.2.module+el8.8.0+18944+7f5acf75 RHSA-2024:0569
RHEL 8.8 EUS libvirt-dbus 1.3.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS libvirt-python +1 8.0.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS nbdkit +18 1.24.0-5.module+el8.8.0+17308+05924798 RHSA-2024:0569
RHEL 8.8 EUS netcf +2 0.2.8-12.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS perl-Sys-Virt 8.0.0-1.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS qemu-img +14 15:6.2.0-33.module+el8.8.0+21116+c283fc6d.4 RHSA-2024:0569
RHEL 8.8 EUS seabios +2 1.16.0-4.module+el8.8.0+19627+2d14cb21 RHSA-2024:0569
RHEL 8.8 EUS sgabios +1 1:0.20170427git-3.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS supermin +1 5.2.1-2.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS swtpm +4 0.7.0-4.20211109gitb79fd91.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS virt-dib +24 1:1.44.0-9.module+el8.8.0+16781+9f4724c2 RHSA-2024:0569
RHEL 8.8 EUS virt-v2v +3 1:1.42.0-22.module+el8.8.0+19067+b66cdac6 RHSA-2024:0569
RHEL 8.6 EUS SLOF 20210217-1.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS hivex +6 1.3.18-23.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS libguestfs-winsupport 8.6-2.module+el8.6.0+19818+47334628 RHSA-2024:0404
RHEL 8.6 EUS libiscsi +2 1.18.0-8.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS libnbd +6 1.6.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS libtpms +1 0.9.1-1.20211126git1ff6fe1f43.module+el8.6.0+18455+e5d5ac9d RHSA-2024:0404
RHEL 8.6 EUS libvirt +27 8.0.0-5.10.module+el8.6.0+18949+ba4ca8a3 RHSA-2024:0404
RHEL 8.6 EUS libvirt-dbus 1.3.0-2.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS libvirt-python +1 8.0.0-1.1.module+el8.6.0+16381+3abc475c RHSA-2024:0404
RHEL 8.6 EUS nbdkit +18 1.24.0-4.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS netcf +2 0.2.8-12.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS perl-Sys-Virt 8.0.0-1.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS qemu-img +14 15:6.2.0-11.module+el8.6.0+20793+2184cc28.11 RHSA-2024:0404
RHEL 8.6 EUS seabios +2 1.15.0-2.module+el8.6.0+19580+39804e41.1 RHSA-2024:0404
RHEL 8.6 EUS sgabios +1 1:0.20170427git-3.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS supermin +1 5.2.1-1.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS swtpm +4 0.7.0-3.20211109gitb79fd91.module+el8.6.0+16156+d5629340 RHSA-2024:0404
RHEL 8.6 EUS virt-dib +24 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2024:0404
RHEL 8.6 EUS virt-v2v +3 1:1.42.0-19.module+el8.6.0+15577+2ffd6ffa RHSA-2024:0404

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 qemu-img +21 17:7.0.0-13.el9 ALSA-2023:6368, ALSA-2022:7967
AlmaLinux 9 qemu-kvm-block-blkio 17:8.0.0-16.el9_3.alma.1 ALSA-2023:6368
AlmaLinux 8 SLOF 20210217-1.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 hivex +6 1.3.18-23.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 libguestfs-winsupport 8.9-1.module_el8.9.0+3662+ef5fc290.alma.1 ALSA-2023:6980
AlmaLinux 8 libiscsi +2 1.18.0-8.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 libnbd +6 1.6.0-5.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module_el8.9.0+3659+9c8643f3 ALSA-2023:6980
AlmaLinux 8 libvirt +27 8.0.0-22.module_el8.9.0+3662+ef5fc290 ALSA-2023:6980
AlmaLinux 8 libvirt-dbus 1.3.0-2.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 nbdkit +18 1.24.0-5.module_el8.8.0+3485+7cffc4a3 ALSA-2023:6980
AlmaLinux 8 netcf +2 0.2.8-12.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 perl-Sys-Virt 8.0.0-1.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 python3-libvirt 8.0.0-2.module_el8.7.0+3346+68867adb ALSA-2023:6980
AlmaLinux 8 qemu-img +14 15:6.2.0-40.module_el8.9.0+3681+41cbbcc0.1.alma.1 ALSA-2023:6980
AlmaLinux 8 seabios +2 1.16.0-4.module_el8.9.0+3659+9c8643f3 ALSA-2023:6980
AlmaLinux 8 sgabios +1 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 ALSA-2023:6980
AlmaLinux 8 supermin +1 5.2.1-2.module_el8.7.0+3346+68867adb ALSA-2023:6980
AlmaLinux 8 swtpm +4 0.7.0-4.20211109gitb79fd91.module_el8.7.0+3346+68867adb ALSA-2023:6980
AlmaLinux 8 virt-dib +24 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma ALSA-2023:6980
AlmaLinux 8 virt-v2v +3 1:1.42.0-22.module_el8.9.0+3659+9c8643f3 ALSA-2023:6980

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 qemu-kvm 7:7.0.0-13.el9 RLSA-2022:7967
Rocky Linux 8 hivex 1.3.18-23.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 libguestfs 1:1.44.0-9.module+el8.10.0+1590+a67ab969.rocky RLSA-2023:6980
Rocky Linux 8 libiscsi 1.18.0-8.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 libnbd 1.6.0-5.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 libtpms 0.9.1-2.20211126git1ff6fe1f43.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 libvirt-dbus 1.3.0-2.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 libvirt-python 8.0.0-2.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 nbdkit 1.24.0-5.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 netcf 0.2.8-12.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 perl-Sys-Virt 8.0.0-1.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 seabios 1.16.0-4.module+el8.9.0+1408+7b966129 RLSA-2023:6980
Rocky Linux 8 sgabios 1:0.20170427git-3.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 supermin 5.2.1-2.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 swtpm 0.7.0-4.20211109gitb79fd91.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
Rocky Linux 8 virt-v2v 1:1.42.0-22.module+el8.10.0+1590+a67ab969 RLSA-2023:6980
ReleasePackageFixed inAdvisory
SLES 15 SP4 qemu 6.2.0-150400.37.23.1 SUSE-SU-2023:4056-1
SLES 15 SP3 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SLES 15 SP2 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1
SLES 15 SP1 qemu 3.1.1.1-150100.80.51.5 SUSE-SU-2023:3800-1
SLES 12 SP5 qemu 3.1.1.1-72.1 SUSE-SU-2024:1395-1
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SLES for SAP 15 SP2 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1
SLES for SAP 15 SP1 qemu 3.1.1.1-150100.80.51.5 SUSE-SU-2023:3800-1
SLES for SAP 12 SP5 qemu 3.1.1.1-72.1 SUSE-SU-2024:1395-1
SLE Micro 5.4 qemu 6.2.0-150400.37.23.1 SUSE-SU-2023:4056-1
SLE Micro 5.3 qemu 6.2.0-150400.37.23.1 SUSE-SU-2023:4056-1
SLE Micro 5.2 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SLE Micro 5.1 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SLE HPC 15 SP3 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SLE HPC 15 SP2 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1
SLE HPC 15 SP1 qemu 3.1.1.1-150100.80.51.5 SUSE-SU-2023:3800-1
SUSE Manager Server 4.2 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SUSE Manager Proxy 4.2 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
SUSE Enterprise Storage 7.1 qemu 5.2.0-150300.127.3 SUSE-SU-2023:3444-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.4 qemu 4.2.1-150200.79.1 SUSE-SU-2023:4056-1, SUSE-SU-2023:3721-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 qemu 6.2.0-18 —
Azure Linux 2 (CBL-Mariner) qemu 6.2.0-16 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 qemu-img +20 17:7.0.0-13.el9 ELSA-2024-12407, ELSA-2022-7967
Oracle Linux 9 qemu-virtiofsd +2 30:7.2.0-11.el9 ELSA-2024-12407
Oracle Linux 8 hivex +6 1.3.18-23.module+el8.9.0+90075+85334608 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 libguestfs-winsupport 8.6-1.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 libiscsi +2 1.18.0-8.module+el8.9.0+90052+d3bf71d8 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 libnbd +6 1.6.0-5.module+el8.9.0+90052+d3bf71d8 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 libtpms +1 0.9.1-0.20211126git1ff6fe1f43.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 libvirt +28 7.10.0-4.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 libvirt-client-qemu 9.0.0-5.module+el8.9.0+90173+a3f3e83a ELSA-2024-12276
Oracle Linux 8 libvirt-dbus 1.3.0-2.module+el8.9.0+90052+d3bf71d8 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 nbdkit +18 1.24.0-4.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 netcf +2 0.2.8-12.module+el8.9.0+90052+d3bf71d8 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 ocaml-libguestfs +1 1:1.44.0-9.0.2.module+el8.9.0+90052+d3bf71d8 ELSA-2023-6980
Oracle Linux 8 perl-Sys-Virt 6.0.0-1.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 qemu-img +10 15:6.1.1-9.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 qemu-kvm-docs +4 15:6.2.0-40.module+el8.9.0+90073+85334608.1 ELSA-2023-6980
Oracle Linux 8 seabios +2 1.15.0-2.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 sgabios +1 1:0.20170427git-3.module+el8.9.0+90052+d3bf71d8 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 supermin +1 5.2.1-1.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 swtpm +4 0.7.0-3.20211109gitb79fd91.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 virt-dib +22 1:1.44.0-5.0.1.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980
Oracle Linux 8 virt-v2v +3 1:1.42.0-19.0.1.module+el8.10.0+90374+95a91213 ELSA-2024-12605, ELSA-2024-12276, ELSA-2023-6980

Advisories 22

References