A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade qemu-audio-paUpgrade qemu-kvmUpgrade qemu-block-sshUpgrade qemu-system-x86-coreUpgrade ivshmem-toolsUpgrade qemu-block-rbdUpgrade qemu-system-aarch64-coreUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-guest-agentUpgrade qemu-audio-ossUpgrade qemu-userUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade qemuUpgrade qemu-system-aarch64Upgrade qemu-audio-sdlUpgrade qemu-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-user-binfmtUpgrade qemu-ui-cursesUpgrade qemu-user-staticUpgrade qemu-ui-sdlUpgrade qemu-block-nfsUpgrade qemu-block-dmgUpgrade qemu-commonUpgrade qemu-imgUpgrade qemu-system-x86 | Jun 6, 2023 | May 26, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | May 26, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | May 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | May 26, 2021 |
| Oracle_linux | — | Upgrade nbdkit-bash-completionUpgrade python3-libvirtUpgrade libvirt-dbusUpgrade qemu-kvm-block-curlUpgrade libvirt-libsUpgrade qemu-block-rbdUpgrade libvirt-adminUpgrade superminUpgrade seabios-binUpgrade virt-dibUpgrade qemu-kvm-commonUpgrade libvirt-develUpgrade nbdkit-ssh-pluginUpgrade libvirt-daemon-config-networkUpgrade seabiosUpgrade libvirt-daemon-driver-interfaceUpgrade libguestfs-gfs2Upgrade qemuUpgrade qemu-guest-agentUpgrade libguestfs-develUpgrade hivex-develUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storageUpgrade nbdkitUpgrade nbdkit-xz-filterUpgrade python3-libguestfsUpgrade sgabios-binUpgrade sgabiosUpgrade supermin-develUpgrade libvirt-daemonUpgrade libiscsi-develUpgrade libvirt-daemon-driver-secretUpgrade nbdfuseUpgrade libnbd-develUpgrade nbdkit-vddk-pluginUpgrade qemu-kvm-block-iscsiUpgrade ivshmem-toolsUpgrade libguestfs-toolsUpgrade perl-Sys-VirtUpgrade python3-hivexUpgrade qemu-block-iscsiUpgrade libvirt-daemon-kvmUpgrade qemu-block-glusterUpgrade libguestfs-rescueUpgrade qemu-commonUpgrade libguestfs-javadocUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-rbdUpgrade netcf-libsUpgrade libiscsi-utilsUpgrade libguestfs-java-develUpgrade libguestfs-rsyncUpgrade libguestfs-bash-completionUpgrade libvirt-daemon-driver-storage-mpathUpgrade nbdkit-example-pluginsUpgrade virt-v2vUpgrade libguestfs-tools-cUpgrade libguestfs-man-pages-ukUpgrade libguestfs-xfsUpgrade libvirt-daemon-driver-storage-scsiUpgrade netcfUpgrade libnbdUpgrade libvirt-daemon-driver-nwfilterUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-block-sshUpgrade nbdkit-basic-pluginsUpgrade nbdkit-basic-filtersUpgrade libvirt-daemon-driver-networkUpgrade qemu-kvm-coreUpgrade ruby-libguestfsUpgrade qemu-kvm-block-glusterUpgrade libguestfsUpgrade libvirt-bash-completionUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade netcf-develUpgrade nbdkit-serverUpgrade nbdkit-develUpgrade libvirt-lock-sanlockUpgrade nbdkit-python-pluginUpgrade hivexUpgrade libguestfs-winsupportUpgrade qemu-system-x86Upgrade qemu-kvmUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-nssUpgrade python3-libnbdUpgrade qemu-system-aarch64-coreUpgrade perl-Sys-GuestfsUpgrade nbdkit-curl-pluginUpgrade libguestfs-javaUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-qemuUpgrade ruby-hivexUpgrade qemu-system-aarch64Upgrade qemu-imgUpgrade perl-hivexUpgrade libvirt-daemon-driver-storage-glusterUpgrade libguestfs-gobject-develUpgrade nbdkit-linuxdisk-pluginUpgrade lua-guestfsUpgrade libvirtUpgrade libiscsiUpgrade libguestfs-man-pages-jaUpgrade qemu-system-x86-coreUpgrade nbdkit-gzip-pluginUpgrade libguestfs-benchmarkingUpgrade libguestfs-inspect-iconsUpgrade libvirt-daemon-driver-storage-coreUpgrade libguestfs-gobjectUpgrade seavgabios-binUpgrade libvirt-daemon-driver-nodedev | Aug 17, 2021 | Apr 30, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 26, 2021 |
| Suse | — | Upgrade qemu-s390xUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-openglUpgrade qemu-ui-gtkUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-glusterUpgrade qemu-hw-usb-redirectUpgrade qemu-armUpgrade qemu-hw-display-qxlUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-iscsiUpgrade qemu-kvmUpgrade qemu-accel-tcg-x86Upgrade qemu-ui-spice-appUpgrade qemuUpgrade qemu-guest-agentUpgrade qemu-audio-spiceUpgrade xen-toolsUpgrade qemu-toolsUpgrade qemu-block-curlUpgrade qemu-ipxeUpgrade qemu-langUpgrade qemu-audio-paUpgrade qemu-chardev-spiceUpgrade xen-libs-32bitUpgrade qemu-ppcUpgrade qemu-block-rbdUpgrade qemu-ui-spice-coreUpgrade qemu-block-sshUpgrade qemu-chardev-baumUpgrade qemu-s390Upgrade qemu-block-nfsUpgrade qemu-extraUpgrade qemu-block-dmgUpgrade qemu-x86Upgrade qemu-vhost-user-gpuUpgrade xen-libsUpgrade qemu-ksmUpgrade qemu-audio-ossUpgrade qemu-ui-cursesUpgrade qemu-vgabiosUpgrade qemu-hw-usb-hostUpgrade qemu-microvmUpgrade qemu-sgabiosUpgrade qemu-audio-alsaUpgrade qemu-hw-display-virtio-gpuUpgrade xenUpgrade xen-doc-htmlUpgrade xen-tools-domUUpgrade qemu-testsuiteUpgrade xen-kmp-paeUpgrade qemu-SLOFUpgrade qemu-ui-sdlUpgrade qemu-ivshmem-toolsUpgrade xen-kmp-defaultUpgrade qemu-audio-sdlUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-skibootUpgrade qemu-linux-userUpgrade qemu-seabios | Aug 21, 2021 | May 26, 2021 |
| Ubuntu | — | Upgrade qemu-common (Ubuntu Pro)Upgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-miscUpgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-systemUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system-s390x (Ubuntu Pro) | Jul 16, 2021 | May 26, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub