CVE-2021-20196 — MEDIUM (6.5)

Vulnerability Description

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qemu	Qemu	5.2.0
Debian	Debian Linux	9.0

Related Weaknesses (CWE)

CWE-476

References

https://bugs.launchpad.net/qemu/+bug/1912780ExploitPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00002.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20210708-0004/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/28/1Mailing ListPatchThird Party Advisory
https://bugs.launchpad.net/qemu/+bug/1912780ExploitPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00002.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20210708-0004/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/28/1Mailing ListPatchThird Party Advisory

FAQ

What is CVE-2021-20196?

CVE-2021-20196 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a bloc...

How severe is CVE-2021-20196?

CVE-2021-20196 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-20196?

Check the references section above for vendor advisories and patch information. Affected products include: Qemu Qemu, Debian Debian Linux.