A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade qemu-audio-paUpgrade qemu-kvmUpgrade qemu-userUpgrade qemu-ui-gtkUpgrade ivshmem-toolsUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-audio-ossUpgrade qemu-system-x86-coreUpgrade qemu-audio-alsaUpgrade qemu-block-iscsiUpgrade qemu-block-curlUpgrade qemu-block-sshUpgrade qemu-system-aarch64-coreUpgrade qemu-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-block-dmgUpgrade qemu-user-staticUpgrade qemu-system-aarch64Upgrade qemu-ui-cursesUpgrade qemu-audio-sdlUpgrade qemu-ui-sdlUpgrade qemuUpgrade qemu-user-binfmtUpgrade qemu-imgUpgrade qemu-commonUpgrade qemu-system-x86Upgrade qemu-block-nfs | Jun 6, 2023 | May 26, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | May 26, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | May 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | May 26, 2021 |
| Oracle_linux | — | Upgrade python3-hivexUpgrade nbdkit-vddk-pluginUpgrade libvirt-daemon-driver-secretUpgrade qemu-kvm-commonUpgrade qemu-block-iscsiUpgrade libvirt-libsUpgrade nbdkitUpgrade nbdkit-bash-completionUpgrade qemu-block-rbdUpgrade perl-Sys-VirtUpgrade qemu-block-glusterUpgrade nbdfuseUpgrade nbdkit-ssh-pluginUpgrade qemu-commonUpgrade qemuUpgrade ivshmem-toolsUpgrade libnbd-develUpgrade libvirt-develUpgrade qemu-kvm-block-iscsiUpgrade libguestfs-develUpgrade qemu-kvm-block-curlUpgrade seabiosUpgrade virt-dibUpgrade libguestfs-rescueUpgrade sgabios-binUpgrade libvirt-daemon-kvmUpgrade libguestfs-gfs2Upgrade sgabiosUpgrade nbdkit-xz-filterUpgrade python3-libguestfsUpgrade supermin-develUpgrade libguestfs-javadocUpgrade libvirt-clientUpgrade hivex-develUpgrade libvirt-daemon-driver-storage-scsiUpgrade netcfUpgrade virt-v2vUpgrade libvirt-daemonUpgrade libguestfs-xfsUpgrade libnbdUpgrade libguestfs-tools-cUpgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-bash-completionUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-rbdUpgrade superminUpgrade libiscsi-develUpgrade python3-libvirtUpgrade netcf-libsUpgrade libvirt-daemon-config-networkUpgrade libvirt-dbusUpgrade libguestfs-toolsUpgrade libguestfs-java-develUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-adminUpgrade libguestfs-man-pages-ukUpgrade seabios-binUpgrade qemu-guest-agentUpgrade libguestfs-rsyncUpgrade nbdkit-example-pluginsUpgrade libvirt-daemon-driver-interfaceUpgrade libiscsi-utilsUpgrade qemu-system-x86-coreUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade nbdkit-develUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-lock-sanlockUpgrade hivexUpgrade qemu-kvmUpgrade libvirt-daemon-driver-storage-diskUpgrade ruby-hivexUpgrade nbdkit-serverUpgrade perl-hivexUpgrade nbdkit-linuxdisk-pluginUpgrade nbdkit-gzip-pluginUpgrade libguestfs-man-pages-jaUpgrade libguestfs-benchmarkingUpgrade nbdkit-basic-filtersUpgrade lua-guestfsUpgrade libvirtUpgrade nbdkit-basic-pluginsUpgrade libiscsiUpgrade qemu-system-aarch64-coreUpgrade nbdkit-curl-pluginUpgrade perl-Sys-GuestfsUpgrade libvirt-daemon-driver-storage-logicalUpgrade libguestfs-javaUpgrade nbdkit-python-pluginUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-nodedevUpgrade python3-libnbdUpgrade seavgabios-binUpgrade libvirt-nssUpgrade libvirt-daemon-driver-networkUpgrade libguestfs-inspect-iconsUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-coreUpgrade libguestfs-gobjectUpgrade libguestfs-winsupportUpgrade qemu-kvm-block-glusterUpgrade libguestfs-gobject-develUpgrade ruby-libguestfsUpgrade qemu-kvm-coreUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-bash-completionUpgrade libguestfsUpgrade qemu-kvm-block-sshUpgrade qemu-kvm-block-rbdUpgrade qemu-imgUpgrade netcf-devel | Aug 17, 2021 | Apr 30, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 26, 2021 |
| Suse | — | Upgrade xen-kmp-paeUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-sgabiosUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-audio-alsaUpgrade qemu-s390Upgrade qemu-chardev-baumUpgrade qemu-testsuiteUpgrade qemu-extraUpgrade xen-libsUpgrade qemu-ksmUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-vhost-user-gpuUpgrade qemu-microvmUpgrade qemu-hw-usb-hostUpgrade xen-doc-htmlUpgrade xenUpgrade qemu-ui-cursesUpgrade xen-kmp-defaultUpgrade qemu-x86Upgrade qemu-audio-ossUpgrade qemu-block-dmgUpgrade qemu-seabiosUpgrade qemu-skibootUpgrade qemu-vgabiosUpgrade qemu-linux-userUpgrade qemu-ivshmem-toolsUpgrade qemu-block-nfsUpgrade qemu-chardev-spiceUpgrade qemu-block-iscsiUpgrade xen-toolsUpgrade qemu-ui-openglUpgrade qemu-audio-spiceUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-hw-usb-smartcardUpgrade xen-tools-domuUpgrade xen-libs-32bitUpgrade qemu-block-sshUpgrade qemuUpgrade qemu-kvmUpgrade qemu-s390xUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-usb-redirectUpgrade qemu-hw-display-qxlUpgrade qemu-block-glusterUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-accel-tcg-x86Upgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-audio-paUpgrade qemu-ui-spice-coreUpgrade qemu-langUpgrade qemu-slofUpgrade qemu-ui-spice-app | Aug 21, 2021 | May 26, 2021 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-s390xUpgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-miscUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-common (Ubuntu Pro) | Jul 16, 2021 | May 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub