Out-of-bounds write in QEMU - CVE-2021-3409

Vulnerability identifier: #VU68559

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3409

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error in the SDHCI controller emulation code. A remote user on the guest OS can trigger an out-of-bounds write and execute arbitrary code on QEMU host.

QEMU
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
qemu-ipxe
qemu-seabios
qemu-vgabios
qemu-guest-agent
qemu-s390
qemu-audio-sdl
qemu-block-ssh-debuginfo
qemu-block-curl-debuginfo
qemu-ui-gtk-debuginfo
qemu-ui-sdl-debuginfo
qemu-audio-pa-debuginfo
qemu-block-curl
qemu-audio-oss
qemu-audio-sdl-debuginfo
qemu-debugsource
qemu-audio-alsa-debuginfo
qemu-block-iscsi
qemu-block-ssh
qemu-block-rbd-debuginfo
qemu-audio-oss-debuginfo
qemu-guest-agent-debuginfo
qemu-s390-debuginfo
qemu-ppc-debuginfo
qemu-ppc
qemu-x86
qemu-kvm
qemu-arm
qemu-arm-debuginfo
qemu-tools-debuginfo
qemu-block-iscsi-debuginfo
qemu-audio-alsa
qemu-block-rbd
qemu
qemu-ui-curses
qemu-audio-pa
qemu-ui-curses-debuginfo
qemu-ui-gtk
qemu-ui-sdl
qemu-lang
qemu-tools
qemu-x86-debuginfo
qemu-debuginfo
qemu-ui-spice-app
qemu-ui-spice-app-debuginfo
qemu-microvm
qemu-sgabios

Install updates from vendor's website.

qemu-ipxe - addressed in versions 1.0.0+-66.1, 1.0.0+-150100.80.43.2, 1.0.0+-150200.69.1
qemu-seabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.0_0_ga698c89-150100.80.43.2, 1.12.1+-150200.69.1
qemu-vgabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.0_0_ga698c89-150100.80.43.2, 1.12.1+-150200.69.1
qemu-guest-agent - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-s390 - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-audio-sdl - update to 3.1.1.1-66.1
qemu-block-ssh-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-curl-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-gtk-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-audio-pa-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-curl - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-audio-oss - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-debugsource - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-audio-alsa-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-iscsi - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-ssh - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-rbd-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-audio-oss-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-guest-agent-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-s390-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ppc-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ppc - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-x86 - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-kvm - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-arm - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-arm-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-tools-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-iscsi-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-audio-alsa - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-block-rbd - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-curses - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-audio-pa - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-curses-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-gtk - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-sdl - update to 3.1.1.1-66.1
qemu-lang - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-tools - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-x86-debuginfo - addressed in versions 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-debuginfo - addressed in versions 3.1.1.1-150100.80.43.2, 4.2.1-150200.69.1
qemu-ui-spice-app - update to 4.2.1-150200.69.1
qemu-ui-spice-app-debuginfo - update to 4.2.1-150200.69.1
qemu-microvm - update to 4.2.1-150200.69.1
qemu-sgabios - addressed in versions 8-66.1, 8-150100.80.43.2, 8-150200.69.1

• https://www.openwall.com/lists/oss-security/2021/03/09/1
• https://bugzilla.redhat.com/show_bug.cgi?id=1928146
• https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html
• https://security.netapp.com/advisory/ntap-20210507-0001/
• https://security.gentoo.org/glsa/202208-27

• Remote code execution in QEMU SDHCI controller emulation
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu