Skip to content
OpenAdvisories
Unscored Public exploit CVE-2021-3929 EUVD-2021-27145GHSA-h66w-323g-4q62

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just lik…

Published Aug 25, 2022 · Updated Feb 28, 2025 · Assigned by redhat

Package: qemu Package: qemu Package: qemu Category: Virtualization Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

Affected products

VendorProductAffectedFixed
— QEMU Fixed in qemu-kvm 7.0.0-rc0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 qemu 1:7.0+dfsg-1 —
Debian 13 qemu 1:7.0+dfsg-1 —
Debian 12 qemu 1:7.0+dfsg-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS qemu 1:6.2+dfsg-2ubuntu6.2 USN-5489-1
Ubuntu 20.04 LTS qemu 1:4.2-3ubuntu6.23 USN-5489-1
Ubuntu 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.40 USN-5489-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLES 15 SP2 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1
SLES 15 SP1 qemu 3.1.1.1-150100.80.51.5 SUSE-SU-2023:3800-1
SLES 12 SP5 qemu 3.1.1.1-66.1 SUSE-SU-2023:0761-1
SLES 12 SP2 qemu 2.6.2-41.76.1 SUSE-SU-2023:2358-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLES for SAP 15 SP2 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1
SLES for SAP 15 SP1 qemu 3.1.1.1-150100.80.51.5 SUSE-SU-2023:3800-1
SLES for SAP 12 SP5 qemu 3.1.1.1-66.1 SUSE-SU-2023:0761-1
SLE Real Time 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE Micro 5.2 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE Micro 5.1 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE HPC 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE HPC 15 SP2 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1
SLE HPC 15 SP1 qemu 3.1.1.1-150100.80.51.5 SUSE-SU-2023:3800-1
SUSE Manager Server 4.2 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SUSE Manager Proxy 4.2 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SUSE Enterprise Storage 7.1 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed qemu 6.2.0-44.1 openSUSE-SU-2024:11969-1
openSUSE Leap 15.4 qemu 4.2.1-150200.79.1 SUSE-SU-2023:3721-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 qemu 6.2.0-18 —
Azure Linux 2 (CBL-Mariner) qemu 6.2.0-13 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 9

References