VDB

CVE-2021-3527

CVE-2021-3527 PUBLISHED

Reported by redhat · Published May 26, 2021

A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
qemu-kvmAmazon Linux10:3.1.0-8.amzn2.0.10
qemu-imgAmazon Linux10:3.1.0-8.amzn2.0.10
qemu-block-dmgAmazon Linux10:3.1.0-8.amzn2.0.10
qemu-block-rbdAmazon Linux10:3.1.0-8.amzn2.0.10
qemu-system-x86Amazon Linux10:3.1.0-8.amzn2.0.10
ivshmem-toolsAmazon Linux10:3.1.0-8.amzn2.0.10
qemu-audio-alsaAmazon Linux10:3.1.0-8.amzn2.0.10
qemuUbuntu:20.04:LTS1:4.2-3ubuntu6.17
qemuUbuntu:18.04:LTS1:2.11+dfsg-1ubuntu7.37
qemuUbuntu:22.04:LTS1:6.0+dfsg-2expubuntu1

Affected products

VendorProductVersions
n/aQEMUall versions
amazon:2qemu-kvm0
amazon:2qemu-img0
amazon:2qemu-block-dmg0
amazon:2qemu-block-rbd0
amazon:2qemu-system-x860
amazon:2ivshmem-tools0
amazon:2qemu-audio-alsa0
n/aQEMU*
amazon:2qemu-system-x86-core0
amazon:2qemu0
amazon:2qemu-ui-sdl0
amazon:2qemu-guest-agent0
amazon:2qemu-user0
amazon:2qemu-block-iscsi0
amazon:2qemu-block-curl0
amazon:2qemu-system-aarch640
amazon:2qemu-ui-gtk0
alpineqemu0
amazon:2qemu-common0

…and 10 more

Timeline

  • May 2, 2021 CVE Published
  • May 27, 2021 EPSS Score (30 in total, the first dated here)
  • Aug 16, 2022 CVE Updated
  • Nov 15, 2023 PoC Published
  • Mar 7, 2026 Distribution Patch (3 in total, the first dated here)
  • Mar 7, 2026 Security Advisory (8 in total, the first dated here)
  • Jul 29, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-3527
vulnetix vdb fixes CVE-2021-3527

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-3527/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›