[oss-security] 20210531 QEMU: security issues in vhost-user-gpumailing list
http://www.openwall.com/lists/oss-security/2021/05/31/1 CVE-2021-3544
MEDIUM
Record summary
CVE-2021-3544 has a selected CVSS score of 6.5 (medium); EIP currently links 1 repository PoC.
Description
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
Description source: CVE List
Exploitation context
Available material
- Repository PoCs
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
QEMU | CVE List | All QEMU versions up to and including 6.0 | affected |
Proofs of concept
1Repository PoCs
GitHubGoultarde/RemoteMouse-3.008-RCERepository PoCby GoultardeStars: 0Not analyzed3 files
References
6bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1958935 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-3544 GLSA-202208-27Vendor advisory
https://security.gentoo.org/glsa/202208-27 security.netapp.comConfirmation
https://security.netapp.com/advisory/ntap-20210720-0008 DSA-4980Vendor advisory
https://www.debian.org/security/2021/dsa-4980