CVE-2021-4158 Null dereference in QEMU

Medium 6.0 Published 24 Aug 2022 Updated 3 Aug 2024

A malicious privileged guest user can crash the QEMU host process via a NULL pointer dereference in ACPI code, causing denial of service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-4158?

CVE-2021-4158 is a medium-severity vulnerability in Qemu Qemu, published on 24 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

Weakness: CWE-476

Which versions are affected by CVE-2021-4158?

It affects 2 products.

Linux distribution packages (1)

qemu openSUSE:Tumbleweed All versions 6.2.0-40.1

Products include Qemu Qemu, Redhat Enterprise Linux.

How do I fix CVE-2021-4158?

Apply the vendor's patch.

Is CVE-2021-4158 being exploited?

There is no known exploitation of CVE-2021-4158 in the wild and no public exploit code.

All Qemu Qemu vulnerabilities

Sources

Also known as AZL-10679, AZL-35153, DEBIAN-CVE-2021-4158, GHSA-9p4w-6fpq-fpm6, UBUNTU-CVE-2021-4158, openSUSE-SU-2024:11862-1.