High severity · published May 2, 2022
CVE-2021-3750
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU
8.2
CVSS
0.5%
EPSS
No
On KEV
Description
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
8.0; 8.0 · source: NVD
QE
Qemu · Qemu
before 7.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3750
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3750
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1999073
Exploit
https://gitlab.com/qemu-project/qemu/-/issues/541
Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/556
Third Party Advisory
https://security.gentoo.org/glsa/202208-27
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0003/
More from Qemu
10.0
CVE-2022-36648
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially…
10.0
CVE-2017-16845
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access
10.0
CVE-2015-8556
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1
9.9
CVE-2016-9603
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update…
9.9
CVE-2017-2620
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue