Use After Free in Qemu
CVE-2021-3750
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
Vulnerability class: Use-After-Free
EPSS: 0.005 (41.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Qemu
- Redhat Enterprise_linux — versions 8.0
- N/a Qemu — versions QEMU before version 7.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (Exploit, Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
Frequently asked questions
- What is CVE-2021-3750?
- CVE-2021-3750 is a high-severity vulnerability in Qemu, classified under Use After Free. CVSS score: 8.2/10. Published 2022-05-02.
- How severe is CVE-2021-3750?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2021-3750 known to be exploited?
- 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.