CVE-2021-3748: canonical ubuntu_linux Use After Free
Vulnerability summary
CVE-2021-3748 is a high (CVSS 7.5) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities.
Not severe (CVSS 7.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 17 · Related 13Timeline
- 23-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.52% on 04-10-2026
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat194 products
- enterprise_linux8.0
- enterprise_linux_advanced_virtualization_eus8.4
- hivex< 0:1.3.18-21.module+el8.4.0+11609+2eba841a | < 0:1.3.18-20.module+el8.2.0+5588+63a201c3
- hivex-debuginfo< 0:1.3.18-21.module+el8.4.0+11609+2eba841a | < 0:1.3.18-20.module+el8.2.0+5588+63a201c3
- hivex-debugsource< 0:1.3.18-21.module+el8.4.0+11609+2eba841a | < 0:1.3.18-20.module+el8.2.0+5588+63a201c3
Debian2 products
- qemu< 1:6.1+dfsg-6
- debian_linuxEOL9.0 | 10.0
Canonical1 product
- ubuntu_linuxEOL18.04 | 20.04 | 21.10
Fedoraproject1 product
- fedoraEOL34
Qemu1 product
- qemu≥ 0.10.0, < 6.2.0
Ubuntu1 product
- qemu< 1:2.11+dfsg-1ubuntu7.39 | < 1:4.2-3ubuntu6.21 | < 1:6.2+dfsg-2ubuntu5
6 vendors · 200 products · Showing 200 of 247
References
21 links- bugzilla.redhat.com/show_bug.cgi?id=1998514X Refsource MISCREPORTIssue TrackingPatchThird Party Advisory
- github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6X Refsource MISCPatchThird Party Advisory
- lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.htmlX Refsource MISCREPORTMailing ListPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/04/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing ListX Refsource MLISTThird Party Advisory