PT-2021-7378 · Qemu+9 · Qemu+9

Prasad J Pandit · Published 2021-02-24 · Updated 2026-06-09 · CVE-2021-3416

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 5.2.0

Description The issue is related to a potential stack overflow via an infinite loop in various NIC emulators of QEMU. This occurs in loopback mode of a NIC where reentrant DMA checks get bypassed, allowing a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial-of-service scenario.

Recommendations For QEMU versions up to and including 5.2.0, update to a version later than 5.2.0 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALSA-2021:3061

ALT-PU-2021-1767

BDU:2022-05839

CESA-2021_3061

CVE-2021-3416

DLA-2623-1

DLA-3099-1

OESA-2021-1191

OPENSUSE-SU-2021:0600-1

OPENSUSE-SU-2021:1942-1

OPENSUSE-SU-2021_0600-1

OPENSUSE-SU-2021_1942-1

OPENSUSE-SU-2024:11287-1

RHSA-2021:3061

RHSA-2021:3703

RHSA-2021_3061

RLSA-2021:3061

SUSE-SU-2021:1240-1

SUSE-SU-2021:1241-1

SUSE-SU-2021:1242-1

SUSE-SU-2021:1243-1

SUSE-SU-2021:1244-1

SUSE-SU-2021:1245-1

SUSE-SU-2021:1305-1

SUSE-SU-2021:14772-1

SUSE-SU-2021:14774-1

SUSE-SU-2021:1942-1

SUSE-SU-2021_14772-1

USN-5010-1

USN-8412-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Qemu

Red Hat

Rocky Linux

Suse

Ubuntu

References · 334

• https://osv.dev/vulnerability/openSUSE-SU-2021:0600-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3592 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15863 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3607 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8412-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5010-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1241-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3593 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1243-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20221 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:3061 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:3061 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3608 · Vendor Advisory