An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2020588 | Issue Tracking Patch Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html | Mailing List Third Party Advisory |
| https://security.gentoo.org/glsa/202208-27 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220225-0007/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
25 Oct 2022, 20:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html - Mailing List, Third Party Advisory | |
| References | (GENTOO) https://security.gentoo.org/glsa/202208-27 - Third Party Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
05 Sep 2022, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Aug 2022, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 May 2022, 15:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html - Mailing List, Third Party Advisory |
04 Apr 2022, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Mar 2022, 13:46
| Type | Values Removed | Values Added |
|---|---|---|
| CPE |
28 Feb 2022, 22:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:6.2.0:-:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_advanced_virtualization_eus:8.4:*:*:*:*:*:*:* |
|
| CWE | CWE-193 | |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220225-0007/ - Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2020588 - Issue Tracking, Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 6.5 |
25 Feb 2022, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Feb 2022, 18:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-18 18:15
Updated : 2024-02-04 22:29
NVD link : CVE-2021-3930
Mitre link : CVE-2021-3930
CVE.ORG link : CVE-2021-3930
JSON object : View
Products Affected
debian
- debian_linux
redhat
- codeready_linux_builder_for_ibm_z_systems
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_advanced_virtualization_eus
- openstack
- enterprise_linux
- codeready_linux_builder_for_power_little_endian
- enterprise_linux_for_power_little_endian
- codeready_linux_builder
qemu
- qemu
CWE
CWE-193
Off-by-one Error