Use After Free Affecting qemu-arm package, versions <4.2.1-150200.79.1


Severity

Recommended
0.0
high
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.09% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use After Free vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES152-QEMUARM-5914744
  • published22 Sept 2023
  • disclosed21 Sept 2023

Introduced: 21 Sep 2023

CVE-2021-3929  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade SLES:15.2 qemu-arm to version 4.2.1-150200.79.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu-arm package and not the qemu-arm package as distributed by SLES. See How to fix? for SLES:15.2 relevant fixed versions and status.

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

CVSS Scores

version 3.1