CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2021-3750

A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.

Score
8.2 high
Published
2022-05-02
Links
NVD · cve.org

Affected ports (2)

PortPackageVersionStatusMaintainer
emulators/qemu-cheriqemu-cheri0.d20260108unaddressedbrooks@FreeBSD.org
emulators/qemu-user-staticqemu-user-static3.1.0_16unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>qemu-cheri</name>
	<range><lt>7.0.0</lt></range>
      </package>
      <package>
	<name>qemu-user-static</name>
	<range><lt>7.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A DMA reentrancy issue was found in the USB EHCI controller emulation
	of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its
	MMIO region when it transfers the USB packets. Crafted content may be
	written to the controller's registers and trigger undesirable actions
	(such as reset) while the device is still transferring packets. This
	can ultimately lead to a use-after-free issue. A malicious guest could
	use this flaw to crash the QEMU process on the host, resulting in a
	denial of service condition, or potentially execute arbitrary code
	within the context of the QEMU process on the host. This flaw affects
	QEMU versions before 7.0.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-3750</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-3750</url>
    </references>
    <dates>
      <discovery>2022-05-02</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>