Every CVE Search/ Get API key

CVE-2021-3611

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A...

6.5 MediumFix available

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Down 0.4 points since May 12, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
CVE-2021-3611
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119, CWE-787
Updated
2026-11-02
CVE List No score

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
CVE-2021-3611
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2021-26915 No score

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
EUVD-2021-26915
Updated
2026-11-03
GitHub AdvisoriesGHSA-rj8x-cp5p-j26r 6.5

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A...

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
GHSA-rj8x-cp5p-j26r
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSVAZL-35150 6.5

CVE-2021-3611 affecting package qemu for versions less than 8.2.0-1

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
AZL-35150
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
CVE-2021-3611
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
Show 20 moreShow less
OSVDEBIAN-CVE-2021-3611 6.5

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
DEBIAN-CVE-2021-3611
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2022-1716 6.5

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.(CVE-2021-3507)

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.(CVE-2021-3611)

Record
OESA-2022-1716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:7967 7.5

Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

Record
RHSA-2022:7967
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:7967 7.5

Moderate: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

The following packages have been upgraded to a later upstream version: qemu-kvm (7.0.0). (BZ#2064757)

Security Fix(es):

  • QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free (CVE-2021-3750)

  • QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

  • QEMU: intel-hda: segmentation fault due to stack overflow (CVE-2021-3611)

  • QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Record
RLSA-2022:7967
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3611 6.5

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

Record
UBUNTU-CVE-2021-3611
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2022:7967 No score

Moderate: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

The following packages have been upgraded to a later upstream version: qemu-kvm (7.0.0). (BZ#2064757)

Security Fix(es):

  • QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free (CVE-2021-3750)
  • QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)
  • QEMU: intel-hda: segmentation fault due to stack overflow (CVE-2021-3611)
  • QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:7967
Updated
2026-11-02
OSVopenSUSE-SU-2021:1202-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3527: usb: unbounded stack allocation in usbredir (bsc#1186012)
  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
  • CVE-2021-3682: usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145)
  • CVE-2020-35503: NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432)
  • CVE-2020-35504,CVE-2020-35505,CVE-2020-35506: NULL pointer dereference in ESP (bsc#1180433 bsc#1180434 bsc#1180435)
  • CVE-2021-20255: eepro100: stack overflow via infinite recursion (bsc#1182651)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1202-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2442-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
openSUSE-SU-2021:2442-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2474-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
openSUSE-SU-2021:2474-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2591-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
  • CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

  • QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
  • Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
Record
openSUSE-SU-2021:2591-1
Updated
2026-11-02
OSVSUSE-SU-2021:2428-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3595: Fixed an invalid pointer initialization may lead to information disclosure (tftp). (bsc#1187366)
  • CVE-2021-3592: Fixed an invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
  • CVE-2021-3594: Fixed an invalid pointer initialization may lead to information disclosure (udp). (bsc#1187367)
  • CVE-2021-3593: Fixed an invalid pointer initialization may lead to information disclosure (udp6). (bsc#1187365)
  • CVE-2021-3611: Fixed a segmentation fault due to stack overflow. (bsc#1187529)
Record
SUSE-SU-2021:2428-1
Updated
2026-11-02
OSVSUSE-SU-2021:2442-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
SUSE-SU-2021:2442-1
Updated
2026-11-02
OSVSUSE-SU-2021:2448-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security fixes:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3582: Fixed possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fixed the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fixed intel-hda segmentation fault due to stack overflow (bsc#1187529)

Other fixes:

  • Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
Record
SUSE-SU-2021:2448-1
Updated
2026-11-02
OSVSUSE-SU-2021:2461-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
SUSE-SU-2021:2461-1
Updated
2026-11-02
OSVSUSE-SU-2021:2474-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
SUSE-SU-2021:2474-1
Updated
2026-11-02
OSVSUSE-SU-2021:2546-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
SUSE-SU-2021:2546-1
Updated
2026-11-02
OSVSUSE-SU-2021:2563-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Record
SUSE-SU-2021:2563-1
Updated
2026-11-02
OSVSUSE-SU-2021:2591-1 No score

Security update for qemu

This update for qemu fixes the following issues:

Security issues fixed:

  • CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
  • CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
  • CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
  • CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
  • CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
  • CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
  • CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
  • CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
  • CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

  • QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
  • Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
Record
SUSE-SU-2021:2591-1
Updated
2026-11-02
OSVSUSE-SU-2025:0432-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3611: Fixed segmentation fault due to stack overflow (bsc#1193914).

Other fixes:

  • qemu.spec: mark bridge.conf as noreplace (bsc#1201944).
Record
SUSE-SU-2025:0432-1
Updated
2026-11-02
OSVUSN-6567-1 No score

qemu vulnerabilities

Gaoning Pan and Xingwei Li discovered that QEMU incorrectly handled the USB xHCI controller device. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2020-14394)

It was discovered that QEMU incorrectly handled the TCG Accelerator. A local attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code and esclate privileges. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-24165)

It was discovered that QEMU incorrectly handled the Intel HD audio device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-3611)

It was discovered that QEMU incorrectly handled the ATI VGA device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3638)

It was discovered that QEMU incorrectly handled the VMWare paravirtual RDMA device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. (CVE-2023-1544)

It was discovered that QEMU incorrectly handled the 9p passthrough filesystem. A malicious guest attacker could possibly use this issue to open special files and escape the exported 9p tree. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-2861)

It was discovered that QEMU incorrectly handled the virtual crypto device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-3180)

It was discovered that QEMU incorrectly handled the built-in VNC server. A remote authenticated attacker could possibly use this issue to cause QEMU to stop responding, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-3255)

It was discovered that QEMU incorrectly handled net device hot-unplugging. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-3301)

It was discovered that QEMU incorrectly handled the built-in VNC server. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-3354)

It was discovered that QEMU incorrectly handled NVME devices. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-40360)

It was discovered that QEMU incorrectly handled NVME devices. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 23.10. (CVE-2023-4135)

It was discovered that QEMU incorrectly handled SCSI devices. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-42467)

It was discovered that QEMU incorrectly handled certain disk offsets. A malicious guest attacker could possibly use this issue to gain control of the host in certain nested virtualization scenarios. (CVE-2023-5088)

Record
USN-6567-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu-guest-agent
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-img
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-audio-pa
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-block-curl
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-block-rbd
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-common
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-core
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-ccw
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
Show 107 moreShow less
Affected packages
PackageAffectedFixed
qemu-kvm-device-display-virtio-gpu-gl
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci-gl
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-vga
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-vga-gl
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-usb-host
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-usb-redirect
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-docs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-tools
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-ui-egl-headless
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-ui-opengl
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-pr-helper
AlmaLinux:9
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu
Azure Linux:3
 before 8.2.0-1
8.2.0-1
qemu
Debian:12
 before 1:7.0+dfsg-1
1:7.0+dfsg-1
qemu
Debian:13
 before 1:7.0+dfsg-1
1:7.0+dfsg-1
qemu
Debian:14
 before 1:7.0+dfsg-1
1:7.0+dfsg-1
qemu
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 4.1.0-66.oe1
4.1.0-66.oe1
qemu
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 4.1.0-70.oe1
4.1.0-70.oe1
qemu
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 6.2.0-39.oe2203
6.2.0-39.oe2203
qemu-guest-agent
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-guest-agent-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-img
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-img-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-audio-pa
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-audio-pa-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-block-curl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-block-curl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-block-rbd
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-block-rbd-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-common
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-common-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-core
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-core-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-ccw
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-ccw-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-gl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-gl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci-gl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci-gl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-vga
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-vga-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-vga-gl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-display-virtio-vga-gl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-usb-host
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-usb-host-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-usb-redirect
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-device-usb-redirect-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-tools
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-ui-egl-headless
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-ui-egl-headless-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-ui-opengl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm-ui-opengl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-pr-helper
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-pr-helper-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 17:7.0.0-13.el9
17:7.0.0-13.el9
qemu-kvm
Rocky Linux:9
From an advisory covering 4 CVEs
 before 7:7.0.0-13.el9
7:7.0.0-13.el9
qemu
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 5 CVEs
 before 2.6.2-41.68.1
2.6.2-41.68.1
qemu
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 4 CVEs
 before 5.2.0-23.1
5.2.0-23.1
qemu
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 4 CVEs
 before 5.2.0-23.1
5.2.0-23.1
qemu
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
 before 3.1.1.1-54.1
3.1.1.1-54.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
 before 3.1.1.1-54.1
3.1.1.1-54.1
qemu
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 5 CVEs
 before 2.11.2-9.49.1
2.11.2-9.49.1
qemu
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 5 CVEs
 before 2.11.2-9.49.1
2.11.2-9.49.1
qemu
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 5 CVEs
 before 2.11.2-9.49.1
2.11.2-9.49.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 5 CVEs
 before 2.11.2-9.49.1
2.11.2-9.49.1
qemu
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 8 CVEs
 before 4.2.1-11.25.2
4.2.1-11.25.2
qemu
SUSE:Linux Enterprise Module for Server Applications 15 SP2
From an advisory covering 8 CVEs
 before 4.2.1-11.25.2
4.2.1-11.25.2
qemu
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 8 CVEs
 before 4.2.1-11.25.2
4.2.1-11.25.2
qemu
SUSE:OpenStack Cloud 9
From an advisory covering 5 CVEs
 before 2.11.2-5.35.1
2.11.2-5.35.1
qemu
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 5 CVEs
 before 2.11.2-5.35.1
2.11.2-5.35.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 5 CVEs
 before 2.11.2-5.35.1
2.11.2-5.35.1
qemu
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 5 CVEs
 before 2.11.2-5.35.1
2.11.2-5.35.1
qemu
SUSE:HPE Helion OpenStack 8
From an advisory covering 5 CVEs
 before 2.9.1-6.53.1
2.9.1-6.53.1
qemu
SUSE:OpenStack Cloud 8
From an advisory covering 5 CVEs
 before 2.9.1-6.53.1
2.9.1-6.53.1
qemu
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 5 CVEs
 before 2.9.1-6.53.1
2.9.1-6.53.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 5 CVEs
 before 2.9.1-6.53.1
2.9.1-6.53.1
qemu
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 5 CVEs
 before 2.9.1-6.53.1
2.9.1-6.53.1
qemu
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 5 CVEs
 before 2.9.1-6.53.1
2.9.1-6.53.1
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Manager Proxy 4.0
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Manager Server 4.0
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Enterprise Storage 6
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2
qemu
SUSE:Linux Enterprise Micro 5.3
 before 6.2.0-150400.37.40.1
6.2.0-150400.37.40.1
qemu
SUSE:Linux Enterprise Micro 5.4
 before 6.2.0-150400.37.40.1
6.2.0-150400.37.40.1
qemu
Ubuntu:22.04:LTS
 before 1:6.2+dfsg-2ubuntu6.16, plus listed versions
1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu41:6.2+dfsg-2ubuntu51:6.2+dfsg-2ubuntu6
Show 15 moreShow less
1:6.2+dfsg-2ubuntu6.11:6.2+dfsg-2ubuntu6.21:6.2+dfsg-2ubuntu6.31:6.2+dfsg-2ubuntu6.41:6.2+dfsg-2ubuntu6.51:6.2+dfsg-2ubuntu6.61:6.2+dfsg-2ubuntu6.71:6.2+dfsg-2ubuntu6.81:6.2+dfsg-2ubuntu6.91:6.2+dfsg-2ubuntu6.101:6.2+dfsg-2ubuntu6.111:6.2+dfsg-2ubuntu6.121:6.2+dfsg-2ubuntu6.131:6.2+dfsg-2ubuntu6.141:6.2+dfsg-2ubuntu6.15
1:6.2+dfsg-2ubuntu6.16
qemu
Ubuntu:20.04:LTS
From an advisory covering 11 CVEs
 before 1:4.2-3ubuntu6.28, plus listed versions
1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1
Show 29 moreShow less
1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.161:4.2-3ubuntu6.171:4.2-3ubuntu6.181:4.2-3ubuntu6.191:4.2-3ubuntu6.211:4.2-3ubuntu6.231:4.2-3ubuntu6.241:4.2-3ubuntu6.251:4.2-3ubuntu6.261:4.2-3ubuntu6.27
1:4.2-3ubuntu6.28
qemu
Ubuntu:22.04:LTS
From an advisory covering 11 CVEs
 before 1:6.2+dfsg-2ubuntu6.16, plus listed versions
1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu41:6.2+dfsg-2ubuntu51:6.2+dfsg-2ubuntu6
Show 15 moreShow less
1:6.2+dfsg-2ubuntu6.11:6.2+dfsg-2ubuntu6.21:6.2+dfsg-2ubuntu6.31:6.2+dfsg-2ubuntu6.41:6.2+dfsg-2ubuntu6.51:6.2+dfsg-2ubuntu6.61:6.2+dfsg-2ubuntu6.71:6.2+dfsg-2ubuntu6.81:6.2+dfsg-2ubuntu6.91:6.2+dfsg-2ubuntu6.101:6.2+dfsg-2ubuntu6.111:6.2+dfsg-2ubuntu6.121:6.2+dfsg-2ubuntu6.131:6.2+dfsg-2ubuntu6.141:6.2+dfsg-2ubuntu6.15
1:6.2+dfsg-2ubuntu6.16
qemu
openSUSE:Leap 15.2
From an advisory covering 15 CVEs
 before 4.2.1-lp152.9.20.1
4.2.1-lp152.9.20.1
qemu-linux-user
openSUSE:Leap 15.2
From an advisory covering 15 CVEs
 before 4.2.1-lp152.9.20.1
4.2.1-lp152.9.20.1
qemu-testsuite
openSUSE:Leap 15.2
From an advisory covering 15 CVEs
 before 4.2.1-lp152.9.20.1
4.2.1-lp152.9.20.1
qemu
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 5.2.0-23.1
5.2.0-23.1
qemu
openSUSE:Leap 15.3
From an advisory covering 8 CVEs
 before 4.2.1-11.25.2
4.2.1-11.25.2
qemu
openSUSE:Leap 15.3
From an advisory covering 9 CVEs
 before 3.1.1.1-9.30.2
3.1.1.1-9.30.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3611 is a medium vulnerability (CVSS 6.5) in Qemu, published July 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in qemu 8.2.0-1.

References

Show 139 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open