CVE-2021-3409

Published: 23 March 2021

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Priority

Cvss 3 Severity Score

5.7

Score breakdown

Status

Package	Release	Status
qemu Launchpad, Ubuntu, Debian	lunar	Released (1:6.0+dfsg-1~ubuntu3)
	impish	Released (1:6.0+dfsg-1~ubuntu3)
	bionic	Released (1:2.11+dfsg-1ubuntu7.37)
	focal	Released (1:4.2-3ubuntu6.17)
	trusty	Needed
	upstream	Needs triage
	xenial	Needed
	hirsute	Released (1:5.2+dfsg-9ubuntu3.1)
	groovy	Released (1:5.0-5ubuntu9.9)
	jammy	Released (1:6.0+dfsg-1~ubuntu3)
	kinetic	Released (1:6.0+dfsg-1~ubuntu3)
	mantic	Released (1:6.0+dfsg-1~ubuntu3)
	Patches: upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=b263d8f928001b5cfa2a993ea43b7a5b3a1811e8 upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=8be45cc947832b3c02144c9d52921f499f2d77fe upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=bc6f28995ff88f5d82c38afcfd65406f0ae375aa upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=5cd7aa3451b76bb19c0f6adc2b931f091e5d7fcd upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=cffb446e8fd19a14e1634c7a3a8b07be3f01d5c9
qemu-kvm Launchpad, Ubuntu, Debian	lunar	Does not exist
	trusty	Does not exist
	xenial	Does not exist
	impish	Does not exist
	upstream	Needs triage
	bionic	Does not exist
	focal	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	mantic	Does not exist

Severity score breakdown

Parameter	Value
Base score	5.7
Attack vector	Local
Attack complexity	Low
Privileges required	High
User interaction	None
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›