CVE-2021-20295: qemu Out-of-bounds Read

Modified

AliasesRHSA-2021:1064

Published 01-04-2022Last modified 03-08-2024

Vulnerability summary

CVE-2021-20295 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in qemu. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.4% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.30%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

01-04-2022
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756, refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.16.5v2.02.1

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.30% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Redhat198 products

hivex< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
hivex-debuginfo< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
hivex-debugsource< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
hivex-devel< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
libguestfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f

libguestfs-bash-completion< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-benchmarking< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-benchmarking-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-debugsource< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-devel< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-gfs2< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-gobject< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-gobject-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-gobject-devel< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-inspect-icons< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-java< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-java-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-java-devel< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-javadoc< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-man-pages-ja< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-man-pages-uk< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-rescue< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-rsync< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-tools< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-tools-c< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-tools-c-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libguestfs-winsupport< 0:8.2-1.module+el8.3.0+6423+e4cb6418
libguestfs-xfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
libiscsi< 0:1.18.0-8.module+el8.1.0+4066+0f1aadab
libiscsi-debuginfo< 0:1.18.0-8.module+el8.1.0+4066+0f1aadab
libiscsi-debugsource< 0:1.18.0-8.module+el8.1.0+4066+0f1aadab
libiscsi-devel< 0:1.18.0-8.module+el8.1.0+4066+0f1aadab
libiscsi-utils< 0:1.18.0-8.module+el8.1.0+4066+0f1aadab
libiscsi-utils-debuginfo< 0:1.18.0-8.module+el8.1.0+4066+0f1aadab
libnbd< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
libnbd-debuginfo< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
libnbd-debugsource< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
libnbd-devel< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
libvirt< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-admin< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-admin-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-bash-completion< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-client< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-client-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-config-network< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-config-nwfilter< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-interface< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-interface-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-network< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-network-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-nodedev< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-nodedev-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-nwfilter< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-nwfilter-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-qemu< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-qemu-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-secret< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-secret-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-core< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-core-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-disk< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-disk-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-gluster< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-gluster-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-iscsi< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-iscsi-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-iscsi-direct< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-iscsi-direct-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-logical< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-logical-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-mpath< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-mpath-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-rbd< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-rbd-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-scsi< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-driver-storage-scsi-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-daemon-kvm< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-dbus< 0:1.3.0-2.module+el8.3.0+6423+e4cb6418
libvirt-dbus-debuginfo< 0:1.3.0-2.module+el8.3.0+6423+e4cb6418
libvirt-dbus-debugsource< 0:1.3.0-2.module+el8.3.0+6423+e4cb6418
libvirt-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-debugsource< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-devel< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-docs< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-libs< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-libs-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-lock-sanlock< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-lock-sanlock-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-nss< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-nss-debuginfo< 0:6.0.0-28.1.module+el8.3.0+10448+0c705bc6
libvirt-python< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
libvirt-python-debugsource< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
lua-guestfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
lua-guestfs-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
nbdfuse< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
nbdfuse-debuginfo< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
nbdkit< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-bash-completion< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-basic-filters< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-basic-filters-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-basic-plugins< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-basic-plugins-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-curl-plugin< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-curl-plugin-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-debugsource< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-devel< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-example-plugins< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-example-plugins-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-gzip-plugin< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-gzip-plugin-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-linuxdisk-plugin< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-linuxdisk-plugin-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-python-plugin< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-python-plugin-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-server< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-server-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-ssh-plugin< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-ssh-plugin-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-vddk-plugin< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-vddk-plugin-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-xz-filter< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
nbdkit-xz-filter-debuginfo< 0:1.16.2-4.module+el8.3.0+6922+fd575af8
netcf< 0:0.2.8-12.module+el8.1.0+4066+0f1aadab
netcf-debuginfo< 0:0.2.8-12.module+el8.1.0+4066+0f1aadab
netcf-debugsource< 0:0.2.8-12.module+el8.1.0+4066+0f1aadab
netcf-devel< 0:0.2.8-12.module+el8.1.0+4066+0f1aadab
netcf-libs< 0:0.2.8-12.module+el8.1.0+4066+0f1aadab
netcf-libs-debuginfo< 0:0.2.8-12.module+el8.1.0+4066+0f1aadab
ocaml-hivex< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
ocaml-hivex-debuginfo< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
ocaml-hivex-devel< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
ocaml-libguestfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
ocaml-libguestfs-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
ocaml-libguestfs-devel< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
ocaml-libnbd< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
ocaml-libnbd-debuginfo< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
ocaml-libnbd-devel< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
perl-hivex< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
perl-hivex-debuginfo< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
perl-Sys-Guestfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
perl-Sys-Guestfs-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
perl-Sys-Virt< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
perl-Sys-Virt-debuginfo< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
perl-Sys-Virt-debugsource< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
python3-hivex< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
python3-hivex-debuginfo< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
python3-libguestfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
python3-libguestfs-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
python3-libnbd< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
python3-libnbd-debuginfo< 0:1.2.2-1.module+el8.3.0+7353+9de0a3cc
python3-libvirt< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
python3-libvirt-debuginfo< 0:6.0.0-1.module+el8.3.0+6423+e4cb6418
qemu-guest-agent< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-guest-agent-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-img< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-img-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-curl< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-curl-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-gluster< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-gluster-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-iscsi< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-iscsi-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-rbd< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-rbd-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-ssh< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-block-ssh-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-common< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-common-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-core< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-core-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-debugsource< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-tests< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
qemu-kvm-tests-debuginfo< 15:4.2.0-34.module+el8.3.0+10437+1ca0c2ba.5
ruby-hivex< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
ruby-hivex-debuginfo< 0:1.3.18-20.module+el8.3.0+6423+e4cb6418
ruby-libguestfs< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
ruby-libguestfs-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
seabios< 0:1.13.0-2.module+el8.3.0+7353+9de0a3cc
seabios-bin< 0:1.13.0-2.module+el8.3.0+7353+9de0a3cc
seavgabios-bin< 0:1.13.0-2.module+el8.3.0+7353+9de0a3cc
sgabios< 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab
sgabios-bin< 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab
SLOF< 0:20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418
supermin< 0:5.1.19-10.module+el8.3.0+6423+e4cb6418
supermin-debuginfo< 0:5.1.19-10.module+el8.3.0+6423+e4cb6418
supermin-debugsource< 0:5.1.19-10.module+el8.3.0+6423+e4cb6418
supermin-devel< 0:5.1.19-10.module+el8.3.0+6423+e4cb6418
virt-dib< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
virt-dib-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
virt-v2v< 1:1.40.2-25.module+el8.3.0+7421+642fe24f
virt-v2v-debuginfo< 1:1.40.2-25.module+el8.3.0+7421+642fe24f

Show all 198

Qemu1 product

qemu< 4.2.0-34

2 vendors · 199 products

References

9 links

bugzilla.redhat.com/show_bug.cgi?id=1944075X Refsource MISCREPORTIssue TrackingVendor Advisory
access.redhat.com/security/cve/CVE-2020-10756X Refsource MISCARTICLEVendor Advisory
security.netapp.com/advisory/ntap-20220519-0003/X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2021:1064Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1064.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-20295REPORT
www.cve.org/CVERecord?id=CVE-2021-20295Advisory
nvd.nist.gov/vuln/detail/CVE-2021-20295AdvisoryOval