Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2021-3594

Published: 15 June 2021

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Priority

Low

Cvss 3 Severity Score

3.8

Score breakdown

Status

Package Release Status
libslirp
Launchpad, Ubuntu, Debian
bionic Does not exist

focal
Released (4.1.0-2ubuntu2.2)
groovy
Released (4.3.1-1ubuntu0.1)
hirsute
Released (4.4.0-1ubuntu0.1)
lunar
Released (4.6.1-1)
trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support)
impish
Released (4.4.0-1ubuntu0.21.10.1)
jammy
Released (4.6.1-1)
kinetic
Released (4.6.1-1)
mantic
Released (4.6.1-1)
Patches:
upstream: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e72a056ec0b2c16e0299fc5c6b94e4ca17
upstream: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/74572be49247c8c5feae7c6e0b50c4f569ca9824
qemu
Launchpad, Ubuntu, Debian
bionic
Released (1:2.11+dfsg-1ubuntu7.37)
focal Not vulnerable
(uses system libslirp)
groovy Not vulnerable
(uses system libslirp)
hirsute Not vulnerable
(uses system libslirp)
lunar Not vulnerable
(uses system libslirp)
upstream Needs triage

impish Not vulnerable
(uses system libslirp)
jammy Not vulnerable
(uses system libslirp)
kinetic Not vulnerable
(uses system libslirp)
trusty Needed

xenial Needed

mantic Not vulnerable
(uses system libslirp)

Severity score breakdown

Parameter Value
Base score 3.8
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N