Integer overflow in QEMU - CVE-2021-20203

Vulnerability identifier: #VU63776

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20203

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to integer overflow in the vmxnet3 NIC emulator of the QEMU. A privileged guest user can pass invalid values for the rx/tx queue size or other NIC parameters and perform a denial of service attack.

QEMU
Ubuntu
openEuler
qemu-system-arm (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system (Ubuntu package)
qemu
qemu-img
qemu-debuginfo
qemu-guest-agent
qemu-debugsource
qemu-help
qemu-seabios
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)

Install updates from vendor's website.

QEMU - update to 6.0.0
qemu-system-arm (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-sparc (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-ppc (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-misc (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-x86 (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-mips (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu - update to 4.1.0-35
qemu-img - update to 4.1.0-35
qemu-debuginfo - update to 4.1.0-35
qemu-guest-agent - update to 4.1.0-35
qemu-debugsource - update to 4.1.0-35
qemu-help - update to 4.1.0-35
qemu-seabios - update to 4.1.0-35
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.21, 1:6.0+dfsg-2expubuntu1.2

• https://bugs.launchpad.net/qemu/+bug/1913873
• https://bugzilla.redhat.com/show_bug.cgi?id=1922441
• https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html

• Ubuntu update for qemu
• openEuler update for qemu