Every CVE Search/ Get API key

CVE-2021-3409

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU...

5.7 MediumFix available

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.49%Down 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.7

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
CVE-2021-3409
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
CVE-2021-3409
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2021-26737 No score

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
EUVD-2021-26737
Updated
2026-11-03
GitHub AdvisoriesGHSA-mx4g-vhmg-3rf6 5.7

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU...

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
GHSA-mx4g-vhmg-3rf6
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2021-3409 5.7

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
ALPINE-CVE-2021-3409
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-03
OSVBELL-CVE-2021-3409 5.7

CVE-2021-3409 does not affect BellSoft software

Record
BELL-CVE-2021-3409
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
Show 10 moreShow less
OSV 5.7

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
CVE-2021-3409
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3409 5.7

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
DEBIAN-CVE-2021-3409
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2021-1191 6.0

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.(CVE-2021-3416)

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.(CVE-2021-3409)

A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.(CVE-2021-3392)

QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.(CVE-2020-25085)

Record
OESA-2021-1191
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3409 5.7

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

Record
UBUNTU-CVE-2021-3409
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2021:1942-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
  • Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
  • Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
  • Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
  • Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
  • For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)
Record
openSUSE-SU-2021:1942-1
Updated
2026-11-02
OSVSUSE-SU-2021:1942-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
  • Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
  • Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
  • Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
  • Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
  • For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)
Record
SUSE-SU-2021:1942-1
Updated
2026-11-02
OSVSUSE-SU-2022:3594-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3409: Fixed an incomplete fix for CVE-2020-17380 and CVE-2020-25085 in sdhi controller. (bsc#1182282)
  • CVE-2021-4206: Fixed an integer overflow in cursor_alloc which can lead to heap buffer overflow. (bsc#1198035)
  • CVE-2021-4207: Fixed a double fetch in qxl_cursor ehich can lead to heap buffer overflow. (bsc#1198037)
  • CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)
  • CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)
Record
SUSE-SU-2022:3594-1
Updated
2026-11-02
OSVSUSE-SU-2022:3768-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3409: Fixed an incomplete fix for CVE-2020-17380 and CVE-2020-25085 in sdhi controller. (bsc#1182282)
  • CVE-2021-4206: Fixed an integer overflow in cursor_alloc which can lead to heap buffer overflow. (bsc#1198035)
  • CVE-2021-4207: Fixed a double fetch in qxl_cursor ehich can lead to heap buffer overflow. (bsc#1198037)
  • CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)
  • CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)
  • CVE-2021-3507: Fixed a heap buffer overflow in DMA read data transfers. (bsc#1185000)
  • CVE-2020-17380: Fixed a heap buffer overflow in sdhci_sdma_transfer_multi_blocks. (bsc#1175144)
Record
SUSE-SU-2022:3768-1
Updated
2026-11-02
OSVSUSE-SU-2023:0761-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • bsc#1172033 (CVE-2020-13253)

  • bsc#1180207 (CVE-2020-14394)

  • bsc#1172382 (CVE-2020-13754)

  • bsc#1198038 (CVE-2022-0216)

  • bsc#1193880 (CVE-2021-3929)

  • bsc#1197653 (CVE-2022-1050)

  • bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

  • bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409), bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414

  • About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

  • bsc#1198035, CVE-2021-4206

Record
SUSE-SU-2023:0761-1
Updated
2026-11-02
OSVUSN-5010-1 No score

qemu vulnerabilities

Lei Sun discovered that QEMU incorrectly handled certain MMIO operations. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-15469)

Wenxiang Qian discovered that QEMU incorrectly handled certain ATAPI commands. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 21.04. (CVE-2020-29443)

Cheolwoo Myung discovered that QEMU incorrectly handled SCSI device emulation. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-35504, CVE-2020-35505, CVE-2021-3392)

Alex Xu discovered that QEMU incorrectly handled the virtio-fs shared file system daemon. An attacker inside the guest could possibly use this issue to read and write to host devices. This issue only affected Ubuntu 20.10. (CVE-2020-35517)

It was discovered that QEMU incorrectly handled ARM Generic Interrupt Controller emulation. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20221)

Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Werner discovered that QEMU incorrectly handled e1000 device emulation. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20257)

It was discovered that QEMU incorrectly handled SDHCI controller emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2021-3409)

It was discovered that QEMU incorrectly handled certain NIC emulation devices. An attacker inside the guest could possibly use this issue to cause QEMU to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3416)

Remy Noel discovered that QEMU incorrectly handled the USB redirector device. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. (CVE-2021-3527)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3544)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could possibly use this issue to obtain sensitive host information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3545)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3546)

It was discovered that QEMU incorrectly handled the PVRDMA device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3582,…

Record
USN-5010-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Alpine:v3.16
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.17
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.18
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.19
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.20
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.21
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.22
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.23
 before 6.0.0-r1
6.0.0-r1
qemu
Alpine:v3.24
 before 6.0.0-r1
6.0.0-r1
qemu
Debian:12
 before 1:5.2+dfsg-10
1:5.2+dfsg-10
Show 34 moreShow less
Affected packages
PackageAffectedFixed
qemu
Debian:13
 before 1:5.2+dfsg-10
1:5.2+dfsg-10
qemu
Debian:14
 before 1:5.2+dfsg-10
1:5.2+dfsg-10
qemu
Debian:9
From an advisory covering 7 CVEs
 before 1:2.8+dfsg-6+deb9u14, plus listed versions
1:2.8+dfsg-61:2.8+dfsg-6+deb9u11:2.8+dfsg-6+deb9u101:2.8+dfsg-6+deb9u111:2.8+dfsg-6+deb9u12
Show 9 moreShow less
1:2.8+dfsg-6+deb9u131:2.8+dfsg-6+deb9u21:2.8+dfsg-6+deb9u31:2.8+dfsg-6+deb9u41:2.8+dfsg-6+deb9u51:2.8+dfsg-6+deb9u61:2.8+dfsg-6+deb9u71:2.8+dfsg-6+deb9u81:2.8+dfsg-6+deb9u9
1:2.8+dfsg-6+deb9u14
qemu
Debian:10
From an advisory covering 10 CVEs
 before 1:3.1+dfsg-8+deb10u10, plus listed versions
1:3.1+dfsg-81:3.1+dfsg-8+deb10u21:3.1+dfsg-8+deb10u31:3.1+dfsg-8+deb10u41:3.1+dfsg-8+deb10u5
Show 5 moreShow less
1:3.1+dfsg-8+deb10u61:3.1+dfsg-8+deb10u71:3.1+dfsg-8+deb10u81:3.1+dfsg-8+deb10u91:3.1+dfsg-8~deb10u1
1:3.1+dfsg-8+deb10u10
qemu
openEuler:20.03-LTS-SP1
From an advisory covering 4 CVEs
 before 4.1.0-44.oe1
4.1.0-44.oe1
qemu
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 14 CVEs
 before 5.2.0-17.1
5.2.0-17.1
qemu
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 14 CVEs
 before 5.2.0-17.1
5.2.0-17.1
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Manager Proxy 4.1
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Manager Server 4.1
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Enterprise Storage 7
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Enterprise Storage 6
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 14 CVEs
 before 3.1.1.1-66.1
3.1.1.1-66.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 14 CVEs
 before 3.1.1.1-66.1
3.1.1.1-66.1
qemu
Ubuntu:Pro:14.04:LTS
 before 2.0.0+dfsg-2ubuntu1.47+esm6, plus listed versions
1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3
Show 45 moreShow less
1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.62.0.0+dfsg-2ubuntu1.72.0.0+dfsg-2ubuntu1.82.0.0+dfsg-2ubuntu1.92.0.0+dfsg-2ubuntu1.102.0.0+dfsg-2ubuntu1.112.0.0+dfsg-2ubuntu1.132.0.0+dfsg-2ubuntu1.142.0.0+dfsg-2ubuntu1.152.0.0+dfsg-2ubuntu1.162.0.0+dfsg-2ubuntu1.172.0.0+dfsg-2ubuntu1.182.0.0+dfsg-2ubuntu1.192.0.0+dfsg-2ubuntu1.202.0.0+dfsg-2ubuntu1.212.0.0+dfsg-2ubuntu1.222.0.0+dfsg-2ubuntu1.242.0.0+dfsg-2ubuntu1.252.0.0+dfsg-2ubuntu1.26
2.0.0+dfsg-2ubuntu1.47+esm6
qemu
Ubuntu:Pro:16.04:LTS
 before 1:2.5+dfsg-5ubuntu10.51+esm4, plus listed versions
1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3
Show 45 moreShow less
1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40
1:2.5+dfsg-5ubuntu10.51+esm4
qemu
Ubuntu:18.04:LTS
 before 1:2.11+dfsg-1ubuntu7.37, plus listed versions
1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2
Show 36 moreShow less
1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.36
1:2.11+dfsg-1ubuntu7.37
qemu
Ubuntu:20.04:LTS
 before 1:4.2-3ubuntu6.17, plus listed versions
1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1
Show 20 moreShow less
1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.16
1:4.2-3ubuntu6.17
qemu
Ubuntu:18.04:LTS
From an advisory covering 20 CVEs
 before 1:2.11+dfsg-1ubuntu7.37, plus listed versions
1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2
Show 36 moreShow less
1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.36
1:2.11+dfsg-1ubuntu7.37
qemu
Ubuntu:20.04:LTS
From an advisory covering 20 CVEs
 before 1:4.2-3ubuntu6.17, plus listed versions
1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1
Show 20 moreShow less
1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.16
1:4.2-3ubuntu6.17
qemu
openSUSE:Leap 15.3
From an advisory covering 14 CVEs
 before 5.2.0-17.1
5.2.0-17.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3409 is a medium vulnerability (CVSS 5.7) in Qemu, published March 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in qemu 6.0.0-r1.

References

Show 96 moreShow less
This page doesn't list everything

Left out here: 37 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open