CVE-2021-4207

HIGH

QEMU - Buffer Overflow

Title source: llm
STIX 2.1

Description

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

References (6)

Core 6
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2036966
Exploit, Third Party Advisory x_refsource_misc
https://starlabs.sg/advisories/21-4207/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2022/dsa-5133
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-27
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html

Scores

CVSS v3 8.2
EPSS 0.0005
EPSS Percentile 15.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-362 CWE-120
Status published
Products (4)
debian/debian_linux 10.0
debian/debian_linux 11.0
qemu/qemu < 7.0.0
redhat/enterprise_linux 8.0 (2 CPE variants)
Published Apr 29, 2022
Tracked Since Feb 18, 2026