A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade qemu-block-curlUpgrade ivshmem-toolsUpgrade qemu-userUpgrade qemu-guest-agentUpgrade qemu-system-aarch64-coreUpgrade qemu-audio-alsaUpgrade qemu-block-iscsiUpgrade qemu-audio-ossUpgrade qemu-audio-paUpgrade qemu-block-sshUpgrade qemu-system-x86-coreUpgrade qemu-block-rbdUpgrade qemu-kvmUpgrade qemu-ui-gtkUpgrade qemu-imgUpgrade qemu-system-x86Upgrade qemu-audio-sdlUpgrade qemu-ui-cursesUpgrade qemuUpgrade qemu-ui-sdlUpgrade qemu-block-nfsUpgrade qemu-user-binfmtUpgrade qemu-kvm-coreUpgrade qemu-block-dmgUpgrade qemu-commonUpgrade qemu-debuginfoUpgrade qemu-system-aarch64Upgrade qemu-user-static | Jun 6, 2023 | May 26, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | May 26, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | May 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | May 26, 2021 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade nbdkit-curl-pluginUpgrade qemu-system-aarch64-coreUpgrade libguestfs-javaUpgrade qemu-imgUpgrade qemu-system-aarch64Upgrade libvirt-daemon-driver-storage-glusterUpgrade ruby-hivexUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-diskUpgrade perl-hivexUpgrade libvirt-daemon-driver-storage-logicalUpgrade libguestfsUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-coreUpgrade perl-Sys-GuestfsUpgrade libvirt-daemon-driver-nodedevUpgrade python3-libnbdUpgrade libvirt-daemon-driver-networkUpgrade qemu-system-x86Upgrade nbdkit-serverUpgrade qemu-kvm-coreUpgrade libguestfs-gobject-develUpgrade ruby-libguestfsUpgrade hivexUpgrade libguestfs-winsupportUpgrade netcf-develUpgrade libvirt-lock-sanlockUpgrade nbdkit-develUpgrade libvirt-daemon-config-nwfilterUpgrade nbdkit-python-pluginUpgrade libvirt-docsUpgrade libguestfs-inspect-iconsUpgrade libguestfs-gobjectUpgrade qemu-system-x86-coreUpgrade libvirt-nssUpgrade nbdkit-basic-pluginsUpgrade nbdkit-linuxdisk-pluginUpgrade nbdkit-basic-filtersUpgrade seavgabios-binUpgrade libguestfs-man-pages-jaUpgrade libiscsiUpgrade libguestfs-benchmarkingUpgrade libvirtUpgrade nbdkit-gzip-pluginUpgrade lua-guestfsUpgrade qemu-kvm-block-glusterUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-block-sshUpgrade qemu-guest-agentUpgrade libguestfs-rescueUpgrade qemu-kvm-commonUpgrade libvirt-daemon-driver-storage-mpathUpgrade libguestfs-bash-completionUpgrade libguestfs-tools-cUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-storage-scsiUpgrade netcfUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libguestfs-man-pages-ukUpgrade libiscsi-utilsUpgrade libiscsi-develUpgrade libvirt-daemon-driver-storageUpgrade libguestfs-rsyncUpgrade libvirt-clientUpgrade perl-Sys-VirtUpgrade nbdkit-vddk-pluginUpgrade nbdkit-ssh-pluginUpgrade nbdfuseUpgrade libvirt-develUpgrade libvirt-daemon-driver-secretUpgrade ivshmem-toolsUpgrade qemu-kvm-block-iscsiUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade python3-hivexUpgrade libnbd-develUpgrade libguestfs-toolsUpgrade qemu-block-iscsiUpgrade nbdkit-xz-filterUpgrade python3-libguestfsUpgrade hivex-develUpgrade supermin-develUpgrade sgabiosUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemonUpgrade libguestfs-javadocUpgrade libguestfs-java-develUpgrade netcf-libsUpgrade nbdkit-example-pluginsUpgrade qemu-block-rbdUpgrade python3-libvirtUpgrade nbdkit-bash-completionUpgrade nbdkitUpgrade libvirt-libsUpgrade libvirt-dbusUpgrade libvirt-adminUpgrade libguestfs-develUpgrade virt-dibUpgrade superminUpgrade seabiosUpgrade qemu-kvm-block-curlUpgrade libvirt-daemon-config-networkUpgrade libnbdUpgrade libvirt-daemon-driver-interfaceUpgrade qemuUpgrade seabios-binUpgrade sgabios-binUpgrade libguestfs-gfs2Upgrade libguestfs-xfsUpgrade libvirt-daemon-driver-nwfilterUpgrade virt-v2v | Aug 17, 2021 | Apr 30, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 26, 2021 |
| Suse | — | Upgrade qemu-s390Upgrade qemu-sgabiosUpgrade qemu-audio-alsaUpgrade qemu-ui-sdlUpgrade qemu-extraUpgrade qemu-ivshmem-toolsUpgrade qemu-hw-display-virtio-vgaUpgrade xen-doc-htmlUpgrade qemu-vhost-user-gpuUpgrade qemu-seabiosUpgrade qemu-block-dmgUpgrade qemu-ui-cursesUpgrade qemu-microvmUpgrade qemu-ksmUpgrade qemu-x86Upgrade qemu-linux-userUpgrade xenUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-audio-ossUpgrade qemu-audio-sdlUpgrade xen-tools-domUUpgrade xen-kmp-defaultUpgrade qemu-SLOFUpgrade qemu-vgabiosUpgrade qemu-skibootUpgrade qemu-chardev-baumUpgrade qemu-block-nfsUpgrade xen-libsUpgrade qemu-hw-usb-hostUpgrade qemu-testsuiteUpgrade xen-kmp-paeUpgrade qemu-s390xUpgrade qemu-ui-spice-coreUpgrade xen-libs-32bitUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-qxlUpgrade qemu-ui-gtkUpgrade qemu-ui-spice-appUpgrade qemu-audio-paUpgrade qemuUpgrade qemu-accel-tcg-x86Upgrade qemu-langUpgrade qemu-ui-openglUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-iscsiUpgrade qemu-toolsUpgrade xen-toolsUpgrade qemu-ppcUpgrade qemu-audio-spiceUpgrade qemu-block-sshUpgrade qemu-chardev-spiceUpgrade qemu-ipxeUpgrade qemu-block-glusterUpgrade qemu-hw-usb-redirectUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade qemu-block-curlUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-rbdUpgrade qemu-arm | Aug 21, 2021 | May 26, 2021 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu (Ubuntu Pro)Upgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-s390xUpgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-miscUpgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro) | Jul 16, 2021 | May 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub