CVE-2021-20221

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-787

Affected software

Vendor	Product	Versions
n/a	qemu	up to, including qemu 4.2.0

References

http://www.openwall.com/lists/oss-security/2021/02/05/1Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1924601Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00024.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210708-0005/Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/02/05/1Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1924601Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00024.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210708-0005/Third Party Advisory

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202227.5A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highes CVE-2021-202245.5An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to Ge CVE-2021-202256.7A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer b CVE-2021-202267.8A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of servic CVE-2021-202275.5A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries l CVE-2021-202287.5A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when CVE-2021-202294.3A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query CVE-2021-20234.7Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12 CVE-2021-202307.5A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and ve CVE-2021-202319.8A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequence CVE-2021-202329.8A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other CVE-2021-202338.2A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assum