{"id":"CVE-2021-3929","aliases":["AZL-10721","AZL-35152","BELL-CVE-2021-3929","DEBIAN-CVE-2021-3929","EUVD-2021-27145","GHSA-h66w-323g-4q62","OESA-2022-1733","SUSE-SU-2023:0761-1","SUSE-SU-2023:0840-1","SUSE-SU-2023:2358-1","SUSE-SU-2023:3721-1","SUSE-SU-2023:3800-1","UBUNTU-CVE-2021-3929","USN-5489-1","openSUSE-SU-2024:11969-1"],"status":"published","title":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE...","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00678,"percentile":0.52605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2021-12-24T00:00:00Z","modified":"2026-10-24T10:50:25Z","exploits":[{"source":"pocgithub","id":"QiuhaoLi/CVE-2021-3929-3947","title":"QiuhaoLi/CVE-2021-3929-3947","date":"2022-05-13","url":"https://github.com/QiuhaoLi/CVE-2021-3929-3947"},{"source":"pocgithub","id":"abraxas/qemu-nvme-sgl-bar","title":"abraxas/qemu-nvme-sgl-bar","date":"2026-10-17","url":"https://github.com/abraxas/qemu-nvme-sgl-bar"}],"fixes":[{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["6.2.0-18"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:7.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:7.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"qemu","fixed_in":["6.2.0-41.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qemu","fixed_in":["6.2.0-44.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-18"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-41.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.76.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.51.5"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.51.5"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.51.5"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.2"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.40"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38","1:2.11+dfsg-1ubuntu7.39"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.23"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.2"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-44.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://gitlab.com/qemu-project/qemu/-/issues/556","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020298","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3929","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://gitlab.com/qemu-project/qemu/-/issues/782","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250228-0010/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3929","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I"},{"url":"https://security.netapp.com/advisory/ntap-20250228-0010"},{"url":"https://github.com/advisories/GHSA-h66w-323g-4q62"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-3929","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3929","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1733","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230761-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172033","tags":["report"]},{"url":"https://bugzilla.suse.com/1172382","tags":["report"]},{"url":"https://bugzilla.suse.com/1175144","tags":["report"]},{"url":"https://bugzilla.suse.com/1180207","tags":["report"]},{"url":"https://bugzilla.suse.com/1182282","tags":["report"]},{"url":"https://bugzilla.suse.com/1185000","tags":["report"]},{"url":"https://bugzilla.suse.com/1193880","tags":["report"]},{"url":"https://bugzilla.suse.com/1197653","tags":["report"]},{"url":"https://bugzilla.suse.com/1198035","tags":["report"]},{"url":"https://bugzilla.suse.com/1198038","tags":["report"]},{"url":"https://bugzilla.suse.com/1198712","tags":["report"]},{"url":"https://bugzilla.suse.com/1201367","tags":["report"]},{"url":"https://bugzilla.suse.com/1205808","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4144","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230840-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202364","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187529","tags":["report"]},{"url":"https://bugzilla.suse.com/1192463","tags":["report"]},{"url":"https://bugzilla.suse.com/1193621","tags":["report"]},{"url":"https://bugzilla.suse.com/1198037","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4207","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233721-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188609","tags":["report"]},{"url":"https://bugzilla.suse.com/1190011","tags":["report"]},{"url":"https://bugzilla.suse.com/1207205","tags":["report"]},{"url":"https://bugzilla.suse.com/1212850","tags":["report"]},{"url":"https://bugzilla.suse.com/1212968","tags":["report"]},{"url":"https://bugzilla.suse.com/1213925","tags":["report"]},{"url":"https://bugzilla.suse.com/1215311","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3354","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233800-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13754","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-3929","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5489-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26354","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3929","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T19:36:36Z","modified":"2025-02-28T13:07:25.655Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-27145","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T19:36:36Z","modified":"2025-02-28T13:07:25Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:53:19.898689Z"}],"ghsa":[{"id":"GHSA-h66w-323g-4q62","title":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE...","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-26T00:03:29Z","modified":"2025-02-28T15:32:00Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:00:05.050542Z"}],"nvd":[{"id":"CVE-2021-3929","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T20:15:09.417Z","modified":"2026-06-17T04:06:00.403Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"AZL-10721","title":"CVE-2021-3929 affecting package qemu for versions less than 6.2.0-13","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T20:15:09Z","modified":"2026-04-21T04:21:24.318793Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-35152","title":"CVE-2021-3929 affecting package qemu for versions less than 6.2.0-18","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T20:15:09Z","modified":"2026-04-21T04:56:19.902888Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2021-3929","title":"CVE-2021-3929 does not affect BellSoft software","status":"withdrawn","published":"2022-08-25T20:15:00Z","modified":"2026-01-26T09:46:52.585466Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-3929","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T20:15:09.417Z","modified":"2026-10-24T10:50:25.228151222Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-3929","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2022-08-25T20:15:09.417Z","modified":"2026-10-23T18:03:32.086760402Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2022-1733","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.(CVE-2021-3929)","status":"published","published":"2022-07-01T11:05:00Z","modified":"2026-08-18T01:16:43.837637121Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-3929","description":"A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.","status":"published","published":"2021-12-24T00:00:00Z","modified":"2026-02-04T04:15:24.849955Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"openSUSE-SU-2024:11969-1","title":"qemu-6.2.0-44.1 on GA media","description":"These are all security issues fixed in the qemu-6.2.0-44.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:04:51.948568Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2023:0761-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- bsc#1172033 (CVE-2020-13253)\n\n- bsc#1180207 (CVE-2020-14394)\n\n- bsc#1172382 (CVE-2020-13754)\n\n- bsc#1198038 (CVE-2022-0216)\n\n- bsc#1193880 (CVE-2021-3929)\n\n- bsc#1197653 (CVE-2022-1050)\n\n- bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)\n  \n- bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409),\n  bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414\n- About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)\n  \n- bsc#1198035, CVE-2021-4206\n","status":"published","published":"2023-03-16T10:35:54Z","modified":"2026-02-04T04:04:51.058114Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0840-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n  \n- CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).\n- CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).\n- CVE-2020-14394: Fixed infinite loop in xhci_ring_chain_length() (bsc#1180207).\n- CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038).\n- CVE-2022-1050: Fixed a use-after-free issue in pvrdma_exec_cmd() in pvrdma (bsc#1197653).\n- CVE-2021-3929: Fixed a DMA reentrancy issue leads to use-after-free in nvme (bsc#1193880).\n\nThe following non-security bugs were fixed:\n\n- Fix bsc#1202364.\n","status":"published","published":"2023-03-21T08:54:28Z","modified":"2026-02-04T04:37:43.316997Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2358-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout() in hw/scsi/lsi53c895a.c (bsc#1198038).\n- CVE-2021-3929: Fixed use-after-free in nvme, caused by DMA reentrancy issue (bsc#1193880).\n- CVE-2021-4207: Fixed heap buffer overflow caused by double fetch in qxl_cursor() (bsc#1198037).\n- CVE-2021-4206: Fixed integer overflow in cursor_alloc() (bsc#1198035).\n- Amend .changes file: avoid declaring a still unfixed CVE, as fixed (bsc#1187529) \n- Fix the build breaks caused by binutils update (bsc#1192463, bsc#1193621)\n","status":"published","published":"2023-06-02T11:36:51Z","modified":"2026-02-04T02:21:21.735197Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:3721-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)\n- CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)\n- CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)\n- CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)\n- CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850)\n- CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)\n- CVE-2021-3638: Fixed an out-of-bounds write due to an inconsistent check in ati_2d_blt(). (bsc#1188609)\n- CVE-2021-3750: Fixed an use-after-free in DMA reentrancy issue. (bsc#1190011)\n- CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).\n- CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).\n\nThe following non-security bug was fixed:\n\n- Prepare for binutils update to 2.41 update (bsc#1215311).\n","status":"published","published":"2023-09-21T07:57:13Z","modified":"2026-02-04T04:33:33.102505Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3800-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)\n- CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)\n- CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)\n- CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)\n- CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850)\n- CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)\n- CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).\n- CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).\n- CVE-2021-3750: Fixed DMA reentrancy issue leads to use-after-free in hcd-ehci (bsc#1190011).\n\nThe following non-security bug was fixed:\n\n- Prepare for binutils update to 2.41 update (bsc#1215311).\n","status":"published","published":"2023-09-27T11:36:03Z","modified":"2026-02-04T03:39:59.892369Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-5489-1","title":"qemu vulnerabilities","description":"Alexander Bulekov discovered that QEMU incorrectly handled floppy disk\nemulation. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly leak\nsensitive information. (CVE-2021-3507)\n\nIt was discovered that QEMU incorrectly handled NVME controller emulation.\nAn attacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2021-3929)\n\nIt was discovered that QEMU incorrectly handled QXL display device\nemulation. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2021-4206, CVE-2021-4207)\n\nJietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that QEMU\nincorrectly handled the virtiofsd shared file system daemon. An attacker\ninside the guest could use this issue to create files with incorrect\nownership, possibly leading to privilege escalation. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2022-0358)\n\nIt was discovered that QEMU incorrectly handled virtio-net devices. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-26353)\n\nIt was discovered that QEMU incorrectly handled vhost-vsock devices. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-26354)\n","status":"published","published":"2022-06-21T14:57:23Z","modified":"2026-04-27T16:19:02.408969791Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}