CVE-2021-3713
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in...
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
CVE-2021-3713- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
CVE-2021-3713- Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2021-26994 No score
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
EUVD-2021-26994- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q4w6-2g7p-pr2c
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in...
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
GHSA-q4w6-2g7p-pr2c- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-3713
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
ALPINE-CVE-2021-3713- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
OSVAZL-6831
CVE-2021-3713 affecting package qemu for versions less than 6.2.0-2
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
AZL-6831- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 17 moreShow less
OSV
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
CVE-2021-3713- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3713
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
DEBIAN-CVE-2021-3713- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2021-1348
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.(CVE-2021-3713)
- Record
OESA-2021-1348- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3713
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- Record
UBUNTU-CVE-2021-3713- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1461-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)
Non-security issues fixed:
- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
- Fix qemu crash while deleting xen-block (bsc#1189234)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1461-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3604-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)
Non-security issues fixed:
- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
- Fix qemu crash while deleting xen-block (bsc#1189234)
- Record
openSUSE-SU-2021:3604-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3605-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)
Non-security issues fixed:
- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
- Fix qemu crash while deleting xen-block (bsc#1189234)
- Record
openSUSE-SU-2021:3605-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3614-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- Record
openSUSE-SU-2021:3614-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11597-1 No score
qemu-6.1.0-34.1 on GA media
These are all security issues fixed in the qemu-6.1.0-34.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11597-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3519-1 No score
Security update for qemu
This update for qemu fixes the following issues:
- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)
- Record
SUSE-SU-2021:3519-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3604-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)
Non-security issues fixed:
- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
- Fix qemu crash while deleting xen-block (bsc#1189234)
- Record
SUSE-SU-2021:3604-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3605-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)
Non-security issues fixed:
- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
- Fix qemu crash while deleting xen-block (bsc#1189234)
- Record
SUSE-SU-2021:3605-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3613-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:3613-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3614-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- Record
SUSE-SU-2021:3614-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3635-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:3635-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3653-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- Record
SUSE-SU-2021:3653-1- Updated
- 2026-11-02
OSVUSN-5307-1 No score
qemu vulnerabilities
Gaoning Pan discovered that QEMU incorrectly handled the floppy disk emulator. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20196)
Gaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly handled certain values. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20203)
It was discovered that the QEMU vhost-user GPU device contained several security issues. An attacker inside the guest could use these issues to cause QEMU to crash, resulting in a denial of service, leak sensitive information, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)
It was discovered that QEMU incorrectly handled bulk transfers from SPICE clients. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3682)
It was discovered that the QEMU UAS device emulation incorrectly handled certain stream numbers. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3713)
It was discovered that the QEMU virtio-net device incorrectly handled certain buffer addresses. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3748)
It was discovered that the QEMU SCSI device emulation incorrectly handled certain MODE SELECT commands. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-3930)
It was discovered that the QEMU ACPI logic incorrectly handled certain values. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 21.10. (CVE-2021-4158)
Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU virtiofsd device incorrectly handled permissions when creating files. An attacker inside the guest could use this issue to create files inside the directory shared by virtiofs with unintended permissions, possibly allowing privilege escalation. This issue only affected Ubuntu 21.10. (CVE-2022-0358)
- Record
USN-5307-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpine:v3.15 |
before 6.1.1-r0 | 6.1.1-r0 |
qemuAzure Linux:2 |
before 6.2.0-2 | 6.2.0-2 |
qemuDebian:12 |
before 1:6.1+dfsg-2 | 1:6.1+dfsg-2 |
qemuDebian:13 |
before 1:6.1+dfsg-2 | 1:6.1+dfsg-2 |
qemuDebian:14 |
before 1:6.1+dfsg-2 | 1:6.1+dfsg-2 |
qemuDebian:9 From an advisory covering 5 CVEs |
before 1:2.8+dfsg-6+deb9u15, plus listed versions 1:2.8+dfsg-61:2.8+dfsg-6+deb9u11:2.8+dfsg-6+deb9u101:2.8+dfsg-6+deb9u111:2.8+dfsg-6+deb9u12 Show 10 moreShow less1:2.8+dfsg-6+deb9u131:2.8+dfsg-6+deb9u141:2.8+dfsg-6+deb9u21:2.8+dfsg-6+deb9u31:2.8+dfsg-6+deb9u41:2.8+dfsg-6+deb9u51:2.8+dfsg-6+deb9u61:2.8+dfsg-6+deb9u71:2.8+dfsg-6+deb9u81:2.8+dfsg-6+deb9u9 |
1:2.8+dfsg-6+deb9u15 |
qemuDebian:10 From an advisory covering 35 CVEs |
before 1:3.1+dfsg-8+deb10u9, plus listed versions 1:3.1+dfsg-81:3.1+dfsg-8+deb10u21:3.1+dfsg-8+deb10u31:3.1+dfsg-8+deb10u41:3.1+dfsg-8+deb10u5 Show 4 moreShow less1:3.1+dfsg-8+deb10u61:3.1+dfsg-8+deb10u71:3.1+dfsg-8+deb10u81:3.1+dfsg-8~deb10u1 |
1:3.1+dfsg-8+deb10u9 |
qemuDebian:11 From an advisory covering 7 CVEs |
before 1:5.2+dfsg-11+deb11u1, plus listed versions 1:5.2+dfsg-11 |
1:5.2+dfsg-11+deb11u1 |
qemuopenEuler:20.03-LTS-SP1 |
before 4.1.0-56.oe1 | 4.1.0-56.oe1 |
qemuopenEuler:20.03-LTS-SP2 |
before 4.1.0-57.oe1 | 4.1.0-57.oe1 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 3.1.1.1-60.2 | 3.1.1.1-60.2 |
qemuSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 3.1.1.1-60.2 | 3.1.1.1-60.2 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 2 CVEs |
before 4.2.1-11.31.3 | 4.2.1-11.31.3 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 2 CVEs |
before 4.2.1-11.31.3 | 4.2.1-11.31.3 |
qemuSUSE:Linux Enterprise Micro 5.0 From an advisory covering 2 CVEs |
before 4.2.1-11.31.3 | 4.2.1-11.31.3 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 5.2.0-106.4 | 5.2.0-106.4 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 SP3 From an advisory covering 2 CVEs |
before 5.2.0-106.4 | 5.2.0-106.4 |
qemuSUSE:Linux Enterprise Micro 5.1 From an advisory covering 2 CVEs |
before 5.2.0-106.4 | 5.2.0-106.4 |
qemuSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Enterprise Storage 6 From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:OpenStack Cloud 9 From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:HPE Helion OpenStack 8 From an advisory covering 2 CVEs |
before 2.9.1-43.62.1 | 2.9.1-43.62.1 |
qemuSUSE:OpenStack Cloud 8 From an advisory covering 2 CVEs |
before 2.9.1-43.62.1 | 2.9.1-43.62.1 |
qemuSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 2 CVEs |
before 2.9.1-43.62.1 | 2.9.1-43.62.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 2.9.1-43.62.1 | 2.9.1-43.62.1 |
qemuSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 2 CVEs |
before 2.9.1-43.62.1 | 2.9.1-43.62.1 |
qemuSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 2 CVEs |
before 2.9.1-43.62.1 | 2.9.1-43.62.1 |
qemuUbuntu:22.04:LTS |
before 1:6.2+dfsg-2ubuntu5, plus listed versions 1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu4 |
1:6.2+dfsg-2ubuntu5 |
qemuUbuntu:18.04:LTS From an advisory covering 11 CVEs |
before 1:2.11+dfsg-1ubuntu7.39, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 38 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.361:2.11+dfsg-1ubuntu7.371:2.11+dfsg-1ubuntu7.38 |
1:2.11+dfsg-1ubuntu7.39 |
qemuUbuntu:20.04:LTS From an advisory covering 11 CVEs |
before 1:4.2-3ubuntu6.21, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 23 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.161:4.2-3ubuntu6.171:4.2-3ubuntu6.181:4.2-3ubuntu6.19 |
1:4.2-3ubuntu6.21 |
qemuopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 4.2.1-lp152.9.23.1 | 4.2.1-lp152.9.23.1 |
qemu-linux-useropenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 4.2.1-lp152.9.23.1 | 4.2.1-lp152.9.23.1 |
qemu-testsuiteopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 4.2.1-lp152.9.23.1 | 4.2.1-lp152.9.23.1 |
qemuopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 4.2.1-11.31.3 | 4.2.1-11.31.3 |
qemuopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 5.2.0-106.4 | 5.2.0-106.4 |
qemu-linux-useropenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 5.2.0-106.3 | 5.2.0-106.3 |
qemu-testsuiteopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 5.2.0-106.3 | 5.2.0-106.3 |
qemuopenSUSE:Leap 15.3 From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 6.1.0-34.1 | 6.1.0-34.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3713 is a high vulnerability (CVSS 7.4) in Qemu, published August 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in qemu 6.1.1-r0.
References
bugzilla.redhat.com/show_bug.cgi?id=1994640
lists.debian.org/debian-lts-announce/2021/09/msg00000.html
security.netapp.com/advisory/ntap-20210923-0006
debian.org/security/2021/dsa-4980
security.gentoo.org/glsa/202208-27
Show 51 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-3713
github.com/advisories/GHSA-q4w6-2g7p-pr2c
security.alpinelinux.org/vuln/CVE-2021-3713
security-tracker.debian.org/tracker/CVE-2021-3713
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1348
suse.com/support/update/announcement/2021/suse-su-20213519-1
bugzilla.suse.com/1189702
ubuntu.com/security/CVE-2021-3713
access.redhat.com/security/cve/CVE-2021-3713
lists.nongnu.org/archive/html/qemu-devel/2021-08/msg02766.html
cve.org/CVERecord?id=CVE-2021-3713
lists.opensuse.org/archives/list/[email protected]/thread/6ANWCSILNO3HSV5PUK6VESGM76PNM5ND