CVE-2021-20181

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-367 CWE-362

Affected software

Vendor	Product	Versions
n/a	qemu	up to, including 5.2.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1927007Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00024.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210720-0009/Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-159/Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1927007Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00024.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210720-0009/Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-159/Third Party Advisory, VDB Entry

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-201828.8A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted envir CVE-2021-201835.4It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search CVE-2021-201844.3It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant CVE-2021-201855.3It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages,CVE-2021-201865.4It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of CVE-2021-201877.2It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP CVE-2021-201887.0A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. Th CVE-2021-20192.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected ar CVE-2021-201908.1A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The hig CVE-2021-201915.5A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature CVE-2021-201933.3A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause CVE-2021-201947.8There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_B