CVE-2021-3593
Low
Description
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
SeverityLow
CVSS3.8
Exploit probability—
Product
Libslirp
PublishedJun 15, 2021
First seenJun 15, 2021
Weakness typeCWE-824CWE-824
How to fix
Update
- libslirp_project libslirp4.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libslirp_project libslirp | v < 4.6.0 | 4.6.0 |
| redhat enterprise_linux | 8.0 | — |
| fedoraproject fedora | 33, 34 | — |
| debian debian_linux | 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.