PT-2021-5459 · Qemu+5 · Qemu+5

Mauro Matteo Cascella · Published 2021-05-10 · Updated 2024-06-15 · CVE-2021-3545

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 6.0

Description An information disclosure issue exists in the virtio vhost-user GPU device of QEMU, specifically in the virgl cmd get capset info() function in contrib/vhost-user-gpu/virgl.c. This issue could allow a malicious guest to exploit the flaw and leak memory from the host due to the read of uninitialized memory.

Recommendations For QEMU versions up to and including 6.0, consider updating to a version that includes a fix for this issue, as the current version may allow unauthorized access to confidential data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Use of Uninitialized Resource

Weakness Enumeration

CWE-200

CWE-908

Related Identifiers

ALT-PU-2021-2713

ALT-PU-2021-3078

ALT-PU-2021-3363

BDU:2021-06303

CVE-2021-3545

DSA-4980-1

OESA-2021-1227

OPENSUSE-SU-2021:1043-1

OPENSUSE-SU-2021:2213-1

OPENSUSE-SU-2021_1043-1

OPENSUSE-SU-2021_2213-1

OPENSUSE-SU-2024:11287-1

SUSE-SU-2021:2212-1

SUSE-SU-2021:2213-1

USN-5010-1

USN-5307-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Qemu

Suse

Ubuntu

References · 229

• https://ubuntu.com/security/CVE-2021-3527 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3392 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3682 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35505 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0358 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3545 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211126SE16 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-9568.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5010-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3594 · Vendor Advisory
• https://debian.org/security/2021/dsa-4980 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2213-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3930 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4980-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2213-1 · Vendor Advisory