CVE-2021-3594

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
Configurations

Configuration 1 (hide)

cpe:2.3:a:libslirp_project:libslirp:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

History

21 Nov 2024, 06:21

Type Values Removed Values Added
References () https://bugzilla.redhat.com/show_bug.cgi?id=1970491 - Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=1970491 - Issue Tracking, Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html - () https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/ -
References () https://security.gentoo.org/glsa/202107-44 - Third Party Advisory () https://security.gentoo.org/glsa/202107-44 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20210805-0004/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20210805-0004/ - Third Party Advisory

07 Nov 2023, 03:38

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/', 'name': 'FEDORA-2021-7cd749f133', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/', 'name': 'FEDORA-2021-71de23bedd', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/ -

Information

Published : 2021-06-15 21:15

Updated : 2024-11-21 06:21


NVD link : CVE-2021-3594

Mitre link : CVE-2021-3594

CVE.ORG link : CVE-2021-3594


JSON object : View

Products Affected

debian

  • debian_linux

libslirp_project

  • libslirp

fedoraproject

  • fedora

redhat

  • enterprise_linux
CWE
CWE-824

Access of Uninitialized Pointer