CVE-2021-3713

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	QEMU	qemu 6.2.0-rc0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1994640Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00000.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20210923-0006/Third Party Advisory
https://www.debian.org/security/2021/dsa-4980Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1994640Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00000.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20210923-0006/Third Party Advisory
https://www.debian.org/security/2021/dsa-4980Third Party Advisory

Timeline

Published: Aug 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-371307.5There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to cons CVE-2021-371316.8There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit t CVE-2021-371325.3PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may ca CVE-2021-371337.5There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confident CVE-2021-371348.1Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for inv CVE-2021-371367.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati CVE-2021-371377.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer CVE-2021-37145.9A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via CVE-2021-371449.1CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect CVE-2021-371457.2A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker CVE-2021-371467.5An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers CVE-2021-371477.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect