A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade qemuUpgrade qemu-commonUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-block-nfsUpgrade qemu-system-aarch64Upgrade qemu-user-binfmtUpgrade qemu-kvm-coreUpgrade qemu-block-dmgUpgrade qemu-debuginfoUpgrade qemu-system-x86Upgrade qemu-imgUpgrade qemu-ui-cursesUpgrade qemu-user-staticUpgrade qemu-userUpgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-block-rbdUpgrade qemu-system-aarch64-coreUpgrade qemu-system-x86-coreUpgrade qemu-audio-alsaUpgrade qemu-audio-ossUpgrade qemu-block-iscsiUpgrade ivshmem-toolsUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-ui-gtkUpgrade qemu-kvm | Jun 6, 2023 | May 26, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | May 26, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | May 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | May 26, 2021 |
| Oracle_linux | — | Upgrade libguestfs-javaUpgrade libvirt-daemon-driver-nodedevUpgrade python3-libnbdUpgrade qemu-system-aarch64-coreUpgrade ruby-hivexUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-glusterUpgrade perl-hivexUpgrade qemu-imgUpgrade libguestfs-inspect-iconsUpgrade netcf-develUpgrade qemu-kvmUpgrade nbdkit-serverUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-storage-logicalUpgrade nbdkit-python-pluginUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade hivexUpgrade libguestfs-winsupportUpgrade libvirt-lock-sanlockUpgrade nbdkit-develUpgrade libguestfs-gobjectUpgrade perl-Sys-GuestfsUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-docsUpgrade libvirt-bash-completionUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-block-glusterUpgrade libguestfsUpgrade qemu-kvm-block-sshUpgrade nbdkit-basic-filtersUpgrade nbdkit-basic-pluginsUpgrade lua-guestfsUpgrade libguestfs-gobject-develUpgrade libguestfs-man-pages-jaUpgrade libiscsiUpgrade libvirtUpgrade ruby-libguestfsUpgrade nbdkit-gzip-pluginUpgrade nbdkit-linuxdisk-pluginUpgrade qemu-system-x86-coreUpgrade libguestfs-benchmarkingUpgrade qemu-kvm-coreUpgrade seavgabios-binUpgrade nbdkit-curl-pluginUpgrade libguestfs-develUpgrade virt-dibUpgrade nbdkitUpgrade libvirt-libsUpgrade libguestfs-java-develUpgrade python3-libguestfsUpgrade nbdkit-xz-filterUpgrade sgabiosUpgrade libvirt-daemon-driver-storage-rbdUpgrade libguestfs-javadocUpgrade supermin-develUpgrade libvirt-daemonUpgrade libguestfs-man-pages-ukUpgrade libguestfs-rsyncUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade virt-v2vUpgrade netcfUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-xfsUpgrade libnbdUpgrade libguestfs-tools-cUpgrade libguestfs-bash-completionUpgrade nbdkit-ssh-pluginUpgrade qemuUpgrade superminUpgrade libvirt-adminUpgrade libvirt-dbusUpgrade libvirt-daemon-config-networkUpgrade seabiosUpgrade qemu-kvm-block-curlUpgrade qemu-block-rbdUpgrade python3-libvirtUpgrade nbdkit-bash-completionUpgrade libnbd-develUpgrade nbdfuseUpgrade qemu-commonUpgrade sgabios-binUpgrade qemu-kvm-commonUpgrade libvirt-develUpgrade qemu-block-glusterUpgrade libvirt-daemon-driver-storageUpgrade libiscsi-utilsUpgrade libiscsi-develUpgrade seabios-binUpgrade qemu-block-iscsiUpgrade libguestfs-gfs2Upgrade qemu-guest-agentUpgrade libguestfs-rescueUpgrade libvirt-daemon-driver-secretUpgrade libguestfs-toolsUpgrade ivshmem-toolsUpgrade qemu-kvm-block-iscsiUpgrade python3-hivexUpgrade perl-Sys-VirtUpgrade nbdkit-vddk-pluginUpgrade libvirt-clientUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-interfaceUpgrade hivex-develUpgrade netcf-libsUpgrade nbdkit-example-plugins | Aug 17, 2021 | Apr 30, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 26, 2021 |
| Suse | — | Upgrade qemu-block-dmgUpgrade qemu-audio-ossUpgrade qemu-ksmUpgrade qemu-audio-sdlUpgrade qemu-vhost-user-gpuUpgrade qemu-ui-cursesUpgrade qemu-skibootUpgrade xen-libsUpgrade qemu-microvmUpgrade qemu-testsuiteUpgrade xen-kmp-defaultUpgrade qemu-SLOFUpgrade xen-kmp-paeUpgrade qemu-ui-sdlUpgrade qemu-x86Upgrade qemu-hw-display-virtio-vgaUpgrade qemu-ivshmem-toolsUpgrade xen-tools-domUUpgrade qemu-vgabiosUpgrade qemu-block-nfsUpgrade qemu-extraUpgrade qemu-hw-usb-hostUpgrade qemu-sgabiosUpgrade xenUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade qemu-chardev-baumUpgrade xen-doc-htmlUpgrade qemu-linux-userUpgrade qemu-s390Upgrade qemu-ui-gtkUpgrade qemu-hw-usb-redirectUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-display-qxlUpgrade qemu-kvmUpgrade qemu-ipxeUpgrade qemu-block-curlUpgrade qemu-block-rbdUpgrade qemu-ui-spice-appUpgrade qemu-hw-usb-smartcardUpgrade qemu-guest-agentUpgrade qemu-armUpgrade qemu-ui-spice-coreUpgrade qemu-block-sshUpgrade qemu-audio-paUpgrade qemu-langUpgrade qemu-block-iscsiUpgrade xen-libs-32bitUpgrade qemu-block-glusterUpgrade qemuUpgrade qemu-s390xUpgrade qemu-ui-openglUpgrade qemu-audio-spiceUpgrade xen-toolsUpgrade qemu-ppcUpgrade qemu-accel-tcg-x86Upgrade qemu-tools | Aug 21, 2021 | May 26, 2021 |
| Ubuntu | — | Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-x86-xenUpgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-utils (Ubuntu Pro)Upgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-x86 | Jul 16, 2021 | May 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub