Out-of-bounds write in QEMU - CVE-2021-3611

Vulnerability identifier: #VU69352

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3611

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the Intel HD Audio device (intel-hda) of QEMU. A remote user of the guest OS trigger an out-of-bounds write and crash the QEMU process on the host.

QEMU
Oracle Linux
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Ubuntu
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu
qemu-x86
qemu-block-curl
qemu-block-curl-debuginfo
qemu-block-rbd
qemu-block-rbd-debuginfo
qemu-block-ssh
qemu-block-ssh-debuginfo
qemu-debugsource
qemu-guest-agent
qemu-guest-agent-debuginfo
qemu-kvm
qemu-x86-debuginfo
qemu-tools-debuginfo
qemu-tools
qemu-lang
qemu-s390-debuginfo
qemu-block-iscsi
qemu-block-iscsi-debuginfo
qemu-s390
qemu-ppc
qemu-ppc-debuginfo
qemu-arm
qemu-arm-debuginfo
qemu-debuginfo
qemu-help
qemu-img
qemu-system-arm (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-x86-microvm (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system (Ubuntu package)
qemu (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-audio-oss
qemu-ivshmem-tools
qemu-audio-jack-debuginfo
qemu-accel-qtest-debuginfo
qemu-ui-spice-app-debuginfo
qemu-audio-alsa
qemu-vhost-user-gpu
qemu-accel-tcg-x86-debuginfo
qemu-linux-user-debugsource
qemu-accel-tcg-x86
qemu-s390x
qemu-s390x-debuginfo
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-chardev-baum-debuginfo
qemu-audio-alsa-debuginfo
qemu-hw-display-virtio-gpu-pci
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-ksm
qemu-block-nfs
qemu-accel-qtest
qemu-ui-gtk
qemu-hw-usb-host-debuginfo
qemu-block-dmg-debuginfo
qemu-audio-pa-debuginfo
qemu-extra
qemu-hw-s390x-virtio-gpu-ccw
qemu-hw-usb-smartcard
qemu-audio-jack
qemu-block-gluster-debuginfo
qemu-ui-gtk-debuginfo
qemu-ui-spice-app
qemu-block-dmg
qemu-chardev-baum
qemu-ui-curses-debuginfo
qemu-block-nfs-debuginfo
qemu-ui-opengl
qemu-linux-user
qemu-linux-user-debuginfo
qemu-audio-pa
qemu-vhost-user-gpu-debuginfo
qemu-block-gluster
qemu-hw-usb-host
qemu-audio-oss-debuginfo
qemu-hw-usb-smartcard-debuginfo
qemu-ivshmem-tools-debuginfo
qemu-ui-curses
qemu-extra-debuginfo
qemu-skiboot
qemu-SLOF
qemu-microvm
qemu-hw-usb-redirect
qemu-hw-display-qxl
qemu-hw-display-qxl-debuginfo
qemu-hw-display-virtio-vga
qemu-hw-usb-redirect-debuginfo
qemu-ui-spice-core-debuginfo
qemu-hw-display-virtio-vga-debuginfo
qemu-audio-spice-debuginfo
qemu-ui-spice-core
qemu-chardev-spice-debuginfo
qemu-hw-display-virtio-gpu
qemu-ui-opengl-debuginfo
qemu-audio-spice
qemu-hw-display-virtio-gpu-debuginfo
qemu-chardev-spice
qemu-kvm (Red Hat package)
qemu-system-xen (Ubuntu package)
qemu-sgabios

Install updates from vendor's website.

QEMU - update to 7.0.0
qemu-ipxe - addressed in versions 1.0.0+-5.35.1, 1.0.0+-6.53.1, 1.0.0+-9.49.1, 1.0.0+-150400.37.40.1, 1.0.0-41.68.1
qemu-vgabios - addressed in versions 1.9.1_0_gb3ef39f-41.68.1, 1.10.2_0_g5f4c7b1-6.53.1, 1.11.0_0_g63451fc-5.35.1, 1.11.0_0_g63451fc-9.49.1, 1.15.0_0_g2dd4b9b-150400.37.40.1
qemu-seabios - addressed in versions 1.9.1_0_gb3ef39f-41.68.1, 1.10.2_0_g5f4c7b1-6.53.1, 1.11.0_0_g63451fc-5.35.1, 1.11.0_0_g63451fc-9.49.1, 1.15.0_0_g2dd4b9b-150400.37.40.1
qemu - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-x86 - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-curl - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-curl-debuginfo - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-rbd - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-rbd-debuginfo - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-ssh - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-ssh-debuginfo - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-debugsource - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-guest-agent - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-guest-agent-debuginfo - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-kvm - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-x86-debuginfo - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-tools-debuginfo - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-tools - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-lang - addressed in versions 2.6.2-41.68.1, 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-s390-debuginfo - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1
qemu-block-iscsi - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-block-iscsi-debuginfo - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-s390 - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1
qemu-ppc - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-ppc-debuginfo - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-arm - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-arm-debuginfo - addressed in versions 2.9.1-6.53.1, 2.11.2-5.35.1, 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-debuginfo - addressed in versions 2.11.2-9.49.1, 6.2.0-150400.37.40.1
qemu-seabios - update to 4.1.0-66
qemu-help - update to 4.1.0-66
qemu-guest-agent - update to 4.1.0-66
qemu-block-curl - update to 4.1.0-66
qemu-img - update to 4.1.0-66
qemu-block-ssh - update to 4.1.0-66
qemu-debugsource - update to 4.1.0-66
qemu-block-iscsi - update to 4.1.0-66
qemu-debuginfo - update to 4.1.0-66
qemu-block-rbd - update to 4.1.0-66
qemu - update to 4.1.0-66
qemu-system-arm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-s390x (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-mips (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-sparc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21
qemu-system-misc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:6.2+dfsg-2ubuntu6.16
qemu-system-x86 (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-ppc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-audio-oss - update to 6.2.0-150400.37.40.1
qemu-ivshmem-tools - update to 6.2.0-150400.37.40.1
qemu-audio-jack-debuginfo - update to 6.2.0-150400.37.40.1
qemu-accel-qtest-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-spice-app-debuginfo - update to 6.2.0-150400.37.40.1
qemu-audio-alsa - update to 6.2.0-150400.37.40.1
qemu-vhost-user-gpu - update to 6.2.0-150400.37.40.1
qemu-accel-tcg-x86-debuginfo - update to 6.2.0-150400.37.40.1
qemu-linux-user-debugsource - update to 6.2.0-150400.37.40.1
qemu-accel-tcg-x86 - update to 6.2.0-150400.37.40.1
qemu-s390x - update to 6.2.0-150400.37.40.1
qemu-s390x-debuginfo - update to 6.2.0-150400.37.40.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 6.2.0-150400.37.40.1
qemu-chardev-baum-debuginfo - update to 6.2.0-150400.37.40.1
qemu-audio-alsa-debuginfo - update to 6.2.0-150400.37.40.1
qemu-hw-display-virtio-gpu-pci - update to 6.2.0-150400.37.40.1
qemu-hw-display-virtio-gpu-pci-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ksm - update to 6.2.0-150400.37.40.1
qemu-block-nfs - update to 6.2.0-150400.37.40.1
qemu-accel-qtest - update to 6.2.0-150400.37.40.1
qemu-ui-gtk - update to 6.2.0-150400.37.40.1
qemu-hw-usb-host-debuginfo - update to 6.2.0-150400.37.40.1
qemu-block-dmg-debuginfo - update to 6.2.0-150400.37.40.1
qemu-audio-pa-debuginfo - update to 6.2.0-150400.37.40.1
qemu-extra - update to 6.2.0-150400.37.40.1
qemu-hw-s390x-virtio-gpu-ccw - update to 6.2.0-150400.37.40.1
qemu-hw-usb-smartcard - update to 6.2.0-150400.37.40.1
qemu-audio-jack - update to 6.2.0-150400.37.40.1
qemu-block-gluster-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-gtk-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-spice-app - update to 6.2.0-150400.37.40.1
qemu-block-dmg - update to 6.2.0-150400.37.40.1
qemu-chardev-baum - update to 6.2.0-150400.37.40.1
qemu-ui-curses-debuginfo - update to 6.2.0-150400.37.40.1
qemu-block-nfs-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-opengl - update to 6.2.0-150400.37.40.1
qemu-linux-user - update to 6.2.0-150400.37.40.1
qemu-linux-user-debuginfo - update to 6.2.0-150400.37.40.1
qemu-audio-pa - update to 6.2.0-150400.37.40.1
qemu-vhost-user-gpu-debuginfo - update to 6.2.0-150400.37.40.1
qemu-block-gluster - update to 6.2.0-150400.37.40.1
qemu-hw-usb-host - update to 6.2.0-150400.37.40.1
qemu-audio-oss-debuginfo - update to 6.2.0-150400.37.40.1
qemu-hw-usb-smartcard-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ivshmem-tools-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-curses - update to 6.2.0-150400.37.40.1
qemu-extra-debuginfo - update to 6.2.0-150400.37.40.1
qemu-skiboot - update to 6.2.0-150400.37.40.1
qemu-SLOF - update to 6.2.0-150400.37.40.1
qemu-microvm - update to 6.2.0-150400.37.40.1
qemu-hw-usb-redirect - update to 6.2.0-150400.37.40.1
qemu-hw-display-qxl - update to 6.2.0-150400.37.40.1
qemu-hw-display-qxl-debuginfo - update to 6.2.0-150400.37.40.1
qemu-hw-display-virtio-vga - update to 6.2.0-150400.37.40.1
qemu-hw-usb-redirect-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-spice-core-debuginfo - update to 6.2.0-150400.37.40.1
qemu-hw-display-virtio-vga-debuginfo - update to 6.2.0-150400.37.40.1
qemu-audio-spice-debuginfo - update to 6.2.0-150400.37.40.1
qemu-ui-spice-core - update to 6.2.0-150400.37.40.1
qemu-chardev-spice-debuginfo - update to 6.2.0-150400.37.40.1
qemu-hw-display-virtio-gpu - update to 6.2.0-150400.37.40.1
qemu-ui-opengl-debuginfo - update to 6.2.0-150400.37.40.1
qemu-audio-spice - update to 6.2.0-150400.37.40.1
qemu-hw-display-virtio-gpu-debuginfo - update to 6.2.0-150400.37.40.1
qemu-chardev-spice - update to 6.2.0-150400.37.40.1
qemu-kvm (Red Hat package) - update to 7.0.0-13.el9
qemu-system-xen (Ubuntu package) - addressed in versions 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-sgabios - addressed in versions 8-5.35.1, 8-6.53.1, 8-9.49.1, 8-41.68.1, 8-150400.37.40.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1973784
• https://gitlab.com/qemu-project/qemu/-/issues/542
• https://security.netapp.com/advisory/ntap-20220624-0001/
• https://security.gentoo.org/glsa/202208-27

• Multiple vulnerabilities in QEMU
• Red Hat Enterprise Linux 9 update for qemu-kvm
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu
• Multiple vulnerabilities in Oracle Linux
• Ubuntu update for qemu
• openEuler update for qemu
• Ubuntu update for qemu
• SUSE update for qemu