AZL-6830
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-6830.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-6830
- Upstream
- Published
- 2021-08-05T20:15:09Z
- Modified
- 2026-04-01T05:21:23.770862Z
- Severity
-
- 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2021-3682 affecting package qemu for versions less than 6.2.0-2
- Details
-
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
- References