CVE details
CVE-2021-4207
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
Affected ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| emulators/qemu-cheri | qemu-cheri | 0.d20260108 | unaddressed | brooks@FreeBSD.org |
| emulators/qemu-user-static | qemu-user-static | 3.1.0_16 | unaddressed | emulation@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>qemu-cheri</name>
<range><lt>7.0.0</lt></range>
</package>
<package>
<name>qemu-user-static</name>
<range><lt>7.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A flaw was found in the QXL display device emulation in QEMU. A double
fetch of guest controlled values `cursor->header.width` and
`cursor->header.height` can lead to the allocation of a small cursor
object followed by a subsequent heap-based buffer overflow. A
malicious privileged guest user could use this flaw to crash the QEMU
process on the host or potentially execute arbitrary code within the
context of the QEMU process.</p>
</body>
</description>
<references>
<cvename>CVE-2021-4207</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-4207</url>
</references>
<dates>
<discovery>2022-04-29</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>