CVE-2021-3593

NameCVE-2021-3593
DescriptionAn invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2970-1, DLA-3362-1
Debian Bugs989994

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libslirp (PTS)bullseye4.4.0-1+deb11u2fixed
bookworm4.7.0-1fixed
sid, trixie4.8.0-1fixed
qemu (PTS)jessie, jessie (lts)1:2.1+dfsg-12+deb8u23fixed
stretch (security)1:2.8+dfsg-6+deb9u17fixed
stretch (lts), stretch1:2.8+dfsg-6+deb9u19fixed
buster1:3.1+dfsg-8+deb10u8vulnerable
buster (security)1:3.1+dfsg-8+deb10u12fixed
bullseye1:5.2+dfsg-11+deb11u3fixed
bullseye (security)1:5.2+dfsg-11+deb11u2fixed
bookworm1:7.2+dfsg-7+deb12u6fixed
trixie1:8.2.4+ds-1fixed
sid1:9.0.2+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libslirpsourcebullseye4.4.0-1+deb11u2
libslirpsource(unstable)4.6.1-1989994
qemusourcejessie(not affected)
qemusourcestretch1:2.8+dfsg-6+deb9u17DLA-2970-1
qemusourcebuster1:3.1+dfsg-8+deb10u10DLA-3362-1
qemusource(unstable)1:4.1-2

Notes

https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e72a056ec0b2c16e0299fc5c6b94e4ca17 (v4.6.0)
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/de71c15de66ba9350bf62c45b05f8fbff166517b (v4.6.0)
qemu 1:4.1-2 switched to system libslirp, marking that version as fixed.
[jessie] - qemu <not-affected> (Vulnerable code introduced later)

Search for package or bug name: Reporting problems