CVE-2021-3592: debian debian_linux Access of Uninitialized Pointer
Vulnerability summary
CVE-2021-3592 is a low (CVSS 3.8) Access of Uninitialized Pointer vulnerability in debian debian_linux. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.7% of scored vulnerabilities.
Not severe (CVSS 3.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 26 · Related 23Timeline
- 15-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated3.8LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.8LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated3.8LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- libslirp< 4.6.1-1
- qemu< 1:4.1-2
- debian_linuxEOL9.0
Ubuntu2 products
- libslirp< 4.1.0-2ubuntu2.2 | < 4.6.1-1
- qemu< 2.0.0+dfsg-2ubuntu1.47+esm4 | < 1:2.5+dfsg-5ubuntu10.51+esm3 | < 1:2.11+dfsg-1ubuntu7.37
Alpine1 product
- libslirp< 4.6.0-r0
Fedoraproject1 product
- fedoraEOL33 | 34
Libslirp_project1 product
- libslirp< 4.6.0
Redhat1 product
6 vendors · 9 products
References
16 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.netapp.com/advisory/ntap-20210805-0004/Third Party Advisory
