Vulnerabilities > CVE-2021-3392 - Use After Free vulnerability in multiple products

CVSS 3.2 - LOW

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

LOW

local

low complexity

NVD

Published: 2021-03-23

Updated: 2022-09-30

Summary

A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.

Vulnerable Configurations

Part	Description	Count
Application	Qemu Qemu Qemu 2.10.0 Qemu Qemu 2.10.1 Qemu Qemu 2.10.2 Qemu Qemu 2.11.0 Qemu Qemu 2.11.1 Qemu Qemu 2.11.2 Qemu Qemu 2.12.0 Qemu Qemu 2.12.1 Qemu Qemu 2.12.50 Qemu Qemu 2.17.2 Qemu Qemu 3.0.0 Qemu Qemu 3.0.1 Qemu Qemu 3.1 Qemu Qemu 3.1.0 Qemu Qemu 3.1.1 Qemu Qemu 3.1.1.1 Qemu Qemu 3.1.50 Qemu Qemu 4.0.0 Qemu Qemu 4.0.1 Qemu Qemu 4.1.0 Qemu Qemu 4.1.1 Qemu Qemu 4.2.0 Qemu Qemu 4.2.0-34 Qemu Qemu 4.2.1 Qemu Qemu 5.0 Qemu Qemu 5.0.0 Qemu Qemu 5.0.1 Qemu Qemu 5.1.0 Qemu Qemu 5.1.1 Qemu Qemu 5.2.0	96
OS	Fedoraproject Fedoraproject Fedora 33	1
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References