CVE-2021-3595

15.06.2021, 21:15

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	3.8 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
redhat	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Vendor	Product	Version
libslirp_project	libslirp	𝑥 < 4.6.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	8.0
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libslirp

bullseye	4.4.0-1+deb11u2 fixed
bookworm	4.7.0-1 fixed
sid	4.8.0-1 fixed
trixie	4.8.0-1 fixed

qemu

bullseye	1:5.2+dfsg-11+deb11u3 fixed
bullseye (security)	1:5.2+dfsg-11+deb11u2 fixed
bookworm	1:7.2+dfsg-7+deb12u7 fixed
sid	1:9.1.1+ds-2 fixed
trixie	1:9.1.1+ds-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

libslirp

noble	Fixed 4.6.1-1 released
mantic	Fixed 4.6.1-1 released
lunar	Fixed 4.6.1-1 released
kinetic	Fixed 4.6.1-1 released
jammy	Fixed 4.6.1-1 released
impish	Fixed 4.4.0-1ubuntu0.21.10.1 released
hirsute	Fixed 4.4.0-1ubuntu0.1 released
groovy	Fixed 4.3.1-1ubuntu0.1 released
focal	Fixed 4.1.0-2ubuntu2.2 released
bionic	dne
xenial	ignored
trusty	dne

qemu

noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	not-affected
focal	not-affected
bionic	Fixed 1:2.11+dfsg-1ubuntu7.37 released
xenial	needed
trusty	needed

Common Weakness Enumeration

CWE-824 - Access of Uninitialized Pointer
The program accesses or uses a pointer that has not been initialized.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1970489

https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html

https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/

https://security.gentoo.org/glsa/202107-44