CVE-2021-3416

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	QEMU	versions up to and including 5.2.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1932827Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00009.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0002/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/26/1Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1932827Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00009.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0002/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/26/1Mailing List, Patch, Third Party Advisory

Timeline

Published: Mar 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-341648.8Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in CVE-2021-341659.8A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin.CVE-2021-341669.8A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin.CVE-2021-341678.8Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.CVE-2021-34174.9An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if CVE-2021-341709.8Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code.CVE-2021-341737.5An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame.CVE-2021-341744.6A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. Any wireless router using BCM4352 and BCM43684 will be affected, such as ASUS CVE-2021-34186.4If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validati CVE-2021-341815.4Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.CVE-2021-341829.8An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions.CVE-2021-341849.8Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h.