CVE-2021-3527

Published: 26 May 2021

A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
qemu Launchpad, Ubuntu, Debian	bionic	Released (1:2.11+dfsg-1ubuntu7.37)
	focal	Released (1:4.2-3ubuntu6.17)
	groovy	Released (1:5.0-5ubuntu9.9)
	hirsute	Released (1:5.2+dfsg-9ubuntu3.1)
	impish	Released (1:6.0+dfsg-2expubuntu1)
	jammy	Released (1:6.0+dfsg-2expubuntu1)
	kinetic	Released (1:6.0+dfsg-2expubuntu1)
	lunar	Released (1:6.0+dfsg-2expubuntu1)
	mantic	Released (1:6.0+dfsg-2expubuntu1)
	trusty	Needed
	upstream	Needs triage
	xenial	Needed
	Patches: upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986 upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=05a40b172e4d691371534828078be47e7fff524c
qemu-kvm Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	impish	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›