Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2021-3595

Published: 15 June 2021

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Priority

Low

Cvss 3 Severity Score

3.8

Score breakdown

Status

Package Release Status
libslirp
Launchpad, Ubuntu, Debian
bionic Does not exist

focal
Released (4.1.0-2ubuntu2.2)
groovy
Released (4.3.1-1ubuntu0.1)
hirsute
Released (4.4.0-1ubuntu0.1)
lunar
Released (4.6.1-1)
trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support)
impish
Released (4.4.0-1ubuntu0.21.10.1)
jammy
Released (4.6.1-1)
kinetic
Released (4.6.1-1)
Patches:
upstream: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e72a056ec0b2c16e0299fc5c6b94e4ca17 (v4.6.0)
upstream: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3f17948137155f025f7809fdc38576d5d2451c3d (v4.6.0)
upstream: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/990163cf3ac86b7875559f49602c4d76f46f6f30 (v4.6.0)
qemu
Launchpad, Ubuntu, Debian
bionic
Released (1:2.11+dfsg-1ubuntu7.37)
focal Not vulnerable
(uses system libslirp)
groovy Not vulnerable
(uses system libslirp)
hirsute Not vulnerable
(uses system libslirp)
impish Not vulnerable
(uses system libslirp)
lunar Not vulnerable
(uses system libslirp)
upstream Needs triage

jammy Not vulnerable
(uses system libslirp)
kinetic Not vulnerable
(uses system libslirp)
trusty Needed

xenial Needed

Severity score breakdown

Parameter Value
Base score 3.8
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N