This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-3416 →

DEBIAN-CVE-2021-3416

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs...

Original description

The description as published by the source.

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 qemu

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-9"}]}]

Debian:13 qemu

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-9"}]}]

Debian:14 qemu

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-9"}]}]

References

advisory security-tracker.debian.org