CVE-2021-3929

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	QEMU	Fixed in qemu-kvm 7.0.0-rc0

References

https://access.redhat.com/security/cve/CVE-2021-3929Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2020298Issue Tracking, Patch, Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385Patch, Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/556Issue Tracking, Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/782Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I/
https://access.redhat.com/security/cve/CVE-2021-3929Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2020298Issue Tracking, Patch, Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385Patch, Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/556Issue Tracking, Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/782Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I/
https://security.netapp.com/advisory/ntap-20250228-0010/

Timeline

Published: Aug 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392909.8Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.10 CVE-2021-392918.8Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0 CVE-2021-392937.5In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can CVE-2021-392957.5In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.CVE-2021-3929610.0In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.CVE-2021-392978.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi CVE-2021-392988.8A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM CVE-2021-392998.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi CVE-2021-39306.5An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page(CVE-2021-393008.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi CVE-2021-393018.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi CVE-2021-393029.8MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.