{"id":"CVE-2021-3713","aliases":["ALPINE-CVE-2021-3713","AZL-6831","DEBIAN-CVE-2021-3713","DLA-2753-1","DLA-3099-1","DSA-4980-1","EUVD-2021-26994","GHSA-q4w6-2g7p-pr2c","OESA-2021-1348","SUSE-SU-2021:3519-1","SUSE-SU-2021:3604-1","SUSE-SU-2021:3605-1","SUSE-SU-2021:3613-1","SUSE-SU-2021:3614-1","SUSE-SU-2021:3635-1","SUSE-SU-2021:3653-1","UBUNTU-CVE-2021-3713","USN-5307-1","openSUSE-SU-2021:1461-1","openSUSE-SU-2021:3604-1","openSUSE-SU-2021:3605-1","openSUSE-SU-2021:3614-1","openSUSE-SU-2024:11597-1"],"status":"published","title":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in...","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00546,"percentile":0.46099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-08-25T18:40:48Z","modified":"2026-11-03T06:32:39Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"qemu","fixed_in":["6.1.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:6.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:6.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:6.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","fixed_in":["4.1.0-56.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"qemu","fixed_in":["4.1.0-57.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.8+dfsg-6+deb9u15"}]}],"versions":["1:2.8+dfsg-6","1:2.8+dfsg-6+deb9u1","1:2.8+dfsg-6+deb9u10","1:2.8+dfsg-6+deb9u11","1:2.8+dfsg-6+deb9u12","1:2.8+dfsg-6+deb9u13","1:2.8+dfsg-6+deb9u14","1:2.8+dfsg-6+deb9u2","1:2.8+dfsg-6+deb9u3","1:2.8+dfsg-6+deb9u4","1:2.8+dfsg-6+deb9u5","1:2.8+dfsg-6+deb9u6","1:2.8+dfsg-6+deb9u7","1:2.8+dfsg-6+deb9u8","1:2.8+dfsg-6+deb9u9"],"bundled":5},{"source":"osv","ecosystem":"Debian:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-8+deb10u9"}]}],"versions":["1:3.1+dfsg-8","1:3.1+dfsg-8+deb10u2","1:3.1+dfsg-8+deb10u3","1:3.1+dfsg-8+deb10u4","1:3.1+dfsg-8+deb10u5","1:3.1+dfsg-8+deb10u6","1:3.1+dfsg-8+deb10u7","1:3.1+dfsg-8+deb10u8","1:3.1+dfsg-8~deb10u1"],"bundled":35},{"source":"osv","ecosystem":"Debian:11","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-11+deb11u1"}]}],"versions":["1:5.2+dfsg-11"],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-56.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-57.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-60.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-60.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-11.31.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-11.31.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-11.31.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-106.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-106.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-106.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-70.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-70.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-70.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-70.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.40.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.40.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.40.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.40.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-43.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-43.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-43.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-43.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-43.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-43.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu5"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.39"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.21"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-lp152.9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-lp152.9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-lp152.9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-11.31.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-106.4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-106.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-106.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-80.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-34.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994640","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210923-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4980","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-27","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3713","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q4w6-2g7p-pr2c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3713","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3713","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1348","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213519-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189702","tags":["report"]},{"url":"https://bugzilla.suse.com/1189938","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3748","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189234","tags":["report"]},{"url":"https://bugzilla.suse.com/1190425","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213605-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213613-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180432","tags":["report"]},{"url":"https://bugzilla.suse.com/1180433","tags":["report"]},{"url":"https://bugzilla.suse.com/1180434","tags":["report"]},{"url":"https://bugzilla.suse.com/1180435","tags":["report"]},{"url":"https://bugzilla.suse.com/1182651","tags":["report"]},{"url":"https://bugzilla.suse.com/1186012","tags":["report"]},{"url":"https://bugzilla.suse.com/1189145","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3682","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213614-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213635-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213653-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3713","tags":["report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg02766.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5307-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0358","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6ANWCSILNO3HSV5PUK6VESGM76PNM5ND/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VSD5Q5DPWCTYJNLRUS2DHTA3G6VDKLMV/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/POCCYWA7A3O442ZTZU3JW7O7VFGCLOEA/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/26KPX43RJBRTCX3JER7CN7MAT4QEGAED/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3713","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T18:40:48Z","modified":"2024-08-03T17:01:08.104Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26994","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T18:40:48Z","modified":"2024-08-03T17:01:08Z","updated_at":"2026-11-03T03:25:11.953192Z"}],"ghsa":[{"id":"GHSA-q4w6-2g7p-pr2c","title":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in...","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2022-05-24T19:12:09Z","modified":"2023-02-03T05:04:33Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:53:34.195392Z"}],"nvd":[{"id":"CVE-2021-3713","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T19:15:15.073Z","modified":"2026-06-17T04:05:37.387Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"ALPINE-CVE-2021-3713","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T19:15:15.073Z","modified":"2026-11-03T06:32:39.333344107Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"AZL-6831","title":"CVE-2021-3713 affecting package qemu for versions less than 6.2.0-2","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T19:15:15Z","modified":"2026-04-21T04:38:23.348829Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2021-3713","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T19:15:15.073Z","modified":"2026-10-24T10:30:54.786045259Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-3713","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T19:15:15.073Z","modified":"2026-10-23T18:03:49.830899449Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1348","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nAn out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u0026gt;data3 and UASDevice-\u0026gt;status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.(CVE-2021-3713)","status":"published","published":"2021-09-24T11:04:37Z","modified":"2026-08-18T01:15:55.622098739Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-3713","description":"An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-\u003edata3 and UASDevice-\u003estatus3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.","status":"published","published":"2021-08-25T19:15:00Z","modified":"2026-02-04T02:38:50.273612Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"DLA-2753-1","title":"qemu - security update","status":"published","published":"2021-09-01T00:00:00Z","modified":"2026-03-09T01:18:54.250868Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3099-1","title":"qemu - security update","status":"published","published":"2022-09-05T00:00:00Z","modified":"2026-03-09T01:23:02.473037Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-4980-1","title":"qemu - security update","status":"published","published":"2021-10-03T00:00:00Z","modified":"2026-03-09T02:10:18.208488Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:1461-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)\n- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)\n\nNon-security issues fixed:\n\n- Add transfer length item in block limits page of scsi vpd (bsc#1190425)\n- Fix qemu crash while deleting xen-block (bsc#1189234)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-11-08T10:03:03Z","modified":"2026-02-04T03:26:45.741545Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3604-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)\n- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)\n\nNon-security issues fixed:\n\n- Add transfer length item in block limits page of scsi vpd (bsc#1190425)\n- Fix qemu crash while deleting xen-block (bsc#1189234)\n","status":"published","published":"2021-11-03T13:59:31Z","modified":"2025-05-07T18:13:05.598092Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3605-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)\n- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)\n\nNon-security issues fixed:\n\n- Add transfer length item in block limits page of scsi vpd (bsc#1190425)\n- Fix qemu crash while deleting xen-block (bsc#1189234)\n","status":"published","published":"2021-11-03T13:59:46Z","modified":"2026-02-04T03:41:11.649146Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3614-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)\n- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)\n- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)\n- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)\n- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)\n- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)\n- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)\n\nNon-security issues fixed:\n\n- Use max host physical address if -cpu max is used (bsc#1188299)\n","status":"published","published":"2021-11-04T11:27:20Z","modified":"2026-02-04T03:46:07.528535Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11597-1","title":"qemu-6.1.0-34.1 on GA media","description":"These are all security issues fixed in the qemu-6.1.0-34.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:40.847602Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3519-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)\n- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)\n","status":"published","published":"2021-10-26T13:38:05Z","modified":"2026-02-04T02:27:58.936885Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3604-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)\n- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)\n\nNon-security issues fixed:\n\n- Add transfer length item in block limits page of scsi vpd (bsc#1190425)\n- Fix qemu crash while deleting xen-block (bsc#1189234)\n","status":"published","published":"2021-11-03T13:59:29Z","modified":"2026-02-04T02:39:59.554807Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3605-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)\n- CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)\n\nNon-security issues fixed:\n\n- Add transfer length item in block limits page of scsi vpd (bsc#1190425)\n- Fix qemu crash while deleting xen-block (bsc#1189234)\n","status":"published","published":"2021-11-03T13:59:50Z","modified":"2025-05-02T04:10:48.771385Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3613-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)\n- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)\n- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)\n- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)\n- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)\n- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)\n- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)\n","status":"published","published":"2021-11-04T11:26:25Z","modified":"2026-02-04T04:14:58.118776Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3614-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)\n- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)\n- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)\n- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)\n- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)\n- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)\n- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)\n\nNon-security issues fixed:\n\n- Use max host physical address if -cpu max is used (bsc#1188299)\n","status":"published","published":"2021-11-04T11:27:35Z","modified":"2026-02-04T04:31:47.827558Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3635-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)\n- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)\n- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)\n- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)\n- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)\n- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)\n- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)\n","status":"published","published":"2021-11-09T09:52:13Z","modified":"2026-02-04T02:13:53.800692Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3653-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)\n- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)\n","status":"published","published":"2021-11-10T16:41:49Z","modified":"2026-02-04T04:35:21.306351Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5307-1","title":"qemu vulnerabilities","description":"Gaoning Pan discovered that QEMU incorrectly handled the floppy disk\nemulator. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2021-20196)\n\nGaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly\nhandled certain values. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2021-20203)\n\nIt was discovered that the QEMU vhost-user GPU device contained several\nsecurity issues. An attacker inside the guest could use these issues to\ncause QEMU to crash, resulting in a denial of service, leak sensitive\ninformation, or possibly execute arbitrary code. This issue only affected\nUbuntu 21.10. (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)\n\nIt was discovered that QEMU incorrectly handled bulk transfers from SPICE\nclients. A remote attacker could use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2021-3682)\n\nIt was discovered that the QEMU UAS device emulation incorrectly handled\ncertain stream numbers. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 21.10.\n(CVE-2021-3713)\n\nIt was discovered that the QEMU virtio-net device incorrectly handled\ncertain buffer addresses. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.  (CVE-2021-3748)\n\nIt was discovered that the QEMU SCSI device emulation incorrectly handled\ncertain MODE SELECT commands. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2021-3930)\n\nIt was discovered that the QEMU ACPI logic incorrectly handled certain\nvalues. An attacker inside the guest could possibly use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only affected\nUbuntu 21.10. (CVE-2021-4158)\n\nJietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU\nvirtiofsd device incorrectly handled permissions when creating files. An\nattacker inside the guest could use this issue to create files inside the\ndirectory shared by virtiofs with unintended permissions, possibly allowing\nprivilege escalation. This issue only affected Ubuntu 21.10.\n(CVE-2022-0358)\n","status":"published","published":"2022-02-28T13:03:07Z","modified":"2026-04-27T19:02:57.234209482Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}