CVE-2021-4206

Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 29 Apr 2022, 16:19
Last modified:21 Mar 2025, 18:03

Vulnerability Summary

Overall Risk (default)
medium
43/100
CVSS Score
8.2 HIGH
v3.1 (nvd)
EPSS Score
0.16% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

29 Apr 2022, 16:19
Published
Vulnerability first disclosed
21 Mar 2025, 18:03
Last Modified
Vulnerability information updated

Description

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

CVSS Metrics

  • v3.1•HIGH•Score: 8.2CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 4.6AV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.16%• Percentile: 37%

Techniques & Countermeasures

  • CWE-190•Integer Overflow or Wraparound

    The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

  • CWE-120•Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

    The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  • CWE-131•Incorrect Calculation of Buffer Size

    The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Affected Systems

  • debian•debian_linux

    10.0 | 11.0

  • qemu•qemu

    < 7.0.0

  • redhat•enterprise_linux

    8.0

References (6)