V
Scaner-VS
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
CVE-2021-3929
AST
HighConfirmedExploit available

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just lik…

CVSS
8.2
High
EPSS
0.01
p45
Published
2021-01-01
Updated
2021-01-01
Description

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

Tags · CWE
LPE
CWE-416
Affected products
QemuQemuQemuQemuQemuQemuQemuQemuQemuQemuQemuQemuQemuQemuQemu-audio-alsaQemu-audio-ossQemu-audio-paQemu-audio-sdlQemu-audio-spiceQemu-aux
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Timeline
2021-01-01
Published
2021-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: L
Local (L)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: H
High (H)
User Interaction
UI: N
None (N)
Scope
S: C
Changed (C)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: H
High (H)
Exploit indicators
EPSS
0.006 · p45
Known exploited (KEV)
No
Known exploits — Сканер-ВС
CVE-2021-3929
github-poc · https://github.com/QiuhaoLi/CVE-2021-3929-3947
Enterprise
Affected products
ProductVendorStatus
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemuTracked
qemu-audio-alsaTracked
qemu-audio-ossTracked
qemu-audio-paTracked
qemu-audio-sdlTracked
qemu-audio-spiceTracked
qemu-auxTracked
Showing first 20 of 187
Source databases
AST
DEB
CVE
RED
UBU