Vulnerabilities > CVE-2021-3545 - Use of Uninitialized Resource vulnerability in multiple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | Qemu
| 67 |
| OS | 1 |
Common Weakness Enumeration (CWE)
References
- http://www.openwall.com/lists/oss-security/2021/05/31/1
- http://www.openwall.com/lists/oss-security/2021/05/31/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1958955
- https://bugzilla.redhat.com/show_bug.cgi?id=1958955
- https://security.gentoo.org/glsa/202208-27
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://www.debian.org/security/2021/dsa-4980
- https://www.debian.org/security/2021/dsa-4980