CVE-2021-3750 Use after free in QEMU
A malicious guest can trigger a use-after-free in QEMU's USB EHCI emulation to crash the host or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3750?
CVE-2021-3750 is a high-severity use after free vulnerability in Qemu Qemu, published on 2 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
Weakness: CWE-416
Which versions are affected by CVE-2021-3750?
It affects 2 products.
Products include Qemu Qemu, Redhat Enterprise Linux.
How do I fix CVE-2021-3750?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-3750 being exploited?
There is no known exploitation of CVE-2021-3750 in the wild and no public exploit code.
Other vulnerabilities in Qemu Qemu
Sources
Also known as AZL-35151, AZL-9701, DEBIAN-CVE-2021-3750, GHSA-2v3x-7c37-r5r2, OESA-2022-1679, UBUNTU-CVE-2021-3750.