Veracode Vulnerability DatabaseVERACODE:35260Remote Code Execution (RCE)
8.2 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
5.7%
qemu is vulnerable to re,mote code execution. The vulnerability exists in nvme_ctrl_reset() function which is triggered by the reentrancy write triggers where a malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.
References
access.redhat.com/security/cve/CVE-2021-3929
bugzilla.redhat.com/show_bug.cgi?id=2020298
gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385
gitlab.com/qemu-project/qemu/-/issues/556
gitlab.com/qemu-project/qemu/-/issues/782
lists.fedoraproject.org/archives/list/[email protected]/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I/
security-tracker.debian.org/tracker/CVE-2021-3929
Related
8.2 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
5.7%