A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade qemu-ui-cursesUpgrade qemu-user-binfmtUpgrade qemu-kvm-coreUpgrade qemu-block-nfsUpgrade qemu-imgUpgrade qemu-audio-sdlUpgrade qemu-user-staticUpgrade qemu-debuginfoUpgrade qemu-block-dmgUpgrade qemu-system-aarch64Upgrade qemuUpgrade qemu-commonUpgrade qemu-ui-sdlUpgrade qemu-system-x86Upgrade qemu-block-rbdUpgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-system-aarch64-coreUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-ui-gtkUpgrade qemu-audio-paUpgrade qemu-block-curlUpgrade qemu-audio-ossUpgrade qemu-user | Jun 6, 2023 | May 26, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | May 26, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | May 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | May 26, 2021 |
| Oracle_linux | — | Upgrade qemu-kvm-block-rbdUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-docsUpgrade libvirt-bash-completionUpgrade libguestfs-winsupportUpgrade libvirt-lock-sanlockUpgrade hivexUpgrade libguestfs-inspect-iconsUpgrade nbdkit-develUpgrade nbdkit-python-pluginUpgrade qemu-system-x86Upgrade libvirt-daemon-config-nwfilterUpgrade qemu-system-aarch64Upgrade ruby-hivexUpgrade perl-hivexUpgrade qemu-imgUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-coreUpgrade netcf-develUpgrade qemu-kvmUpgrade libvirt-daemon-driver-storage-glusterUpgrade libguestfs-gobjectUpgrade nbdkit-serverUpgrade nbdkit-curl-pluginUpgrade perl-Sys-GuestfsUpgrade qemu-system-aarch64-coreUpgrade qemu-kvm-block-glusterUpgrade qemu-kvm-coreUpgrade ruby-libguestfsUpgrade libguestfs-man-pages-jaUpgrade nbdkit-basic-pluginsUpgrade libiscsiUpgrade libvirt-daemon-driver-networkUpgrade nbdkit-gzip-pluginUpgrade libguestfsUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-storage-logicalUpgrade nbdkit-linuxdisk-pluginUpgrade libvirtUpgrade libvirt-nssUpgrade lua-guestfsUpgrade nbdkit-basic-filtersUpgrade python3-libnbdUpgrade qemu-system-x86-coreUpgrade seavgabios-binUpgrade qemu-kvm-block-sshUpgrade libguestfs-gobject-develUpgrade libguestfs-javaUpgrade libguestfs-benchmarkingUpgrade libguestfs-xfsUpgrade qemu-guest-agentUpgrade libvirt-develUpgrade python3-hivexUpgrade libguestfs-toolsUpgrade ivshmem-toolsUpgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-bash-completionUpgrade netcfUpgrade nbdkit-example-pluginsUpgrade sgabiosUpgrade libvirt-daemon-driver-storage-mpathUpgrade seabios-binUpgrade libiscsi-utilsUpgrade libiscsi-develUpgrade libvirt-daemon-driver-storageUpgrade sgabios-binUpgrade qemu-kvm-commonUpgrade qemuUpgrade libvirt-daemon-kvmUpgrade libguestfs-rescueUpgrade libguestfs-gfs2Upgrade libvirt-daemon-driver-interfaceUpgrade libvirt-clientUpgrade nbdkit-xz-filterUpgrade libguestfs-develUpgrade superminUpgrade qemu-kvm-block-curlUpgrade seabiosUpgrade nbdkitUpgrade qemu-block-rbdUpgrade python3-libvirtUpgrade nbdkit-bash-completionUpgrade libvirt-dbusUpgrade libvirt-daemon-config-networkUpgrade libvirt-adminUpgrade libvirt-libsUpgrade virt-dibUpgrade libnbdUpgrade virt-v2vUpgrade libvirt-daemon-driver-storage-scsiUpgrade libguestfs-tools-cUpgrade qemu-block-iscsiUpgrade libguestfs-rsyncUpgrade libguestfs-man-pages-ukUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade hivex-develUpgrade supermin-develUpgrade python3-libguestfsUpgrade libvirt-daemonUpgrade libguestfs-javadocUpgrade libvirt-daemon-driver-storage-rbdUpgrade nbdkit-ssh-pluginUpgrade libguestfs-java-develUpgrade netcf-libsUpgrade libvirt-daemon-driver-secretUpgrade nbdkit-vddk-pluginUpgrade qemu-kvm-block-iscsiUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade perl-Sys-VirtUpgrade nbdfuseUpgrade libnbd-devel | Aug 17, 2021 | Apr 30, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 26, 2021 |
| Suse | — | Upgrade xen-toolsUpgrade qemu-audio-spiceUpgrade qemu-ui-spice-appUpgrade qemuUpgrade qemu-accel-tcg-x86Upgrade qemu-ui-openglUpgrade qemu-hw-usb-redirectUpgrade qemu-block-curlUpgrade qemu-armUpgrade qemu-hw-usb-smartcardUpgrade qemu-hw-display-qxlUpgrade qemu-guest-agentUpgrade qemu-block-glusterUpgrade qemu-block-rbdUpgrade xen-libs-32bitUpgrade qemu-toolsUpgrade qemu-block-sshUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-iscsiUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-ui-spice-coreUpgrade qemu-ipxeUpgrade qemu-langUpgrade qemu-chardev-spiceUpgrade qemu-ui-gtkUpgrade qemu-s390xUpgrade qemu-ppcUpgrade qemu-linux-userUpgrade qemu-block-dmgUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-nfsUpgrade xen-tools-domUUpgrade qemu-ivshmem-toolsUpgrade qemu-audio-alsaUpgrade xenUpgrade qemu-sgabiosUpgrade qemu-chardev-baumUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-s390Upgrade xen-kmp-paeUpgrade qemu-testsuiteUpgrade xen-kmp-defaultUpgrade qemu-SLOFUpgrade qemu-ksmUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-skibootUpgrade xen-libsUpgrade qemu-x86Upgrade qemu-vhost-user-gpuUpgrade qemu-ui-cursesUpgrade qemu-microvmUpgrade qemu-vgabiosUpgrade qemu-audio-ossUpgrade qemu-seabiosUpgrade qemu-hw-usb-hostUpgrade qemu-extraUpgrade xen-doc-html | Aug 21, 2021 | May 26, 2021 |
| Ubuntu | — | Upgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-utils (Ubuntu Pro)Upgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-system-miscUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-x86-microvmUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-arm (Ubuntu Pro) | Jul 16, 2021 | May 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub