CVE-2021-3409
Medium
Description
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
SeverityMedium
CVSS5.7
Exploit probability—
Product
Qemu
PublishedMar 23, 2021
First seenMar 23, 2021
Weakness typeCWE-119Memory buffer bounds error
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qemu qemu | v ≤ 5.2.0 | — |
| redhat enterprise_linux | 7.0 | — |
| fedoraproject fedora | 33 | — |
| debian debian_linux | 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.