Release of invalid pointer or reference in QEMU - CVE-2021-3682

Vulnerability identifier: #VU63778

CSH Severity: Low

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3682

CWE-ID: CWE-763

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists in the USB redirector device emulation of QEMU when dropping packets during a bulk transfer from a SPICE client. A remote user can make QEMU call free() with faked heap chunk metadata to perform a denial of service or escalate privileges on the system.

QEMU
Debian Linux
Ubuntu
openEuler
qemu-system-misc (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-help
qemu-img
qemu-guest-agent
qemu-debugsource
qemu-block-iscsi
qemu-block-rbd
qemu-block-ssh
qemu-debuginfo
qemu-block-curl
qemu
qemu-seabios
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu (Debian package)
VMware Tanzu Operations Manager

Install updates from vendor's website.

QEMU - update to 6.1.1
qemu-system-misc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-aarch64 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
qemu (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6
qemu-system-mips (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-ppc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-arm (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-x86 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-sparc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-s390x (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
VMware Tanzu Operations Manager - addressed in versions 2.10.51, 3.0.2
qemu-help - update to 4.1.0-54
qemu-img - update to 4.1.0-54
qemu-guest-agent - update to 4.1.0-54
qemu-debugsource - update to 4.1.0-54
qemu-block-iscsi - update to 4.1.0-54
qemu-block-rbd - update to 4.1.0-54
qemu-block-ssh - update to 4.1.0-54
qemu-debuginfo - update to 4.1.0-54
qemu-block-curl - update to 4.1.0-54
qemu - update to 4.1.0-54
qemu-seabios - update to 4.1.0-54
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.24, 1:6.0+dfsg-2expubuntu1.2, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu (Debian package) - update to 1:5.2+dfsg-11+deb11u1

• https://bugzilla.redhat.com/show_bug.cgi?id=1989651
• https://security.netapp.com/advisory/ntap-20210902-0006/
• https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html
• https://www.debian.org/security/2021/dsa-4980

• Ubuntu update for qemu
• Debian update for qemu
• VMware Tanzu Operations Manager update for QEMU
• openEuler update for qemu
• Ubuntu update for qemu