01 Record

CVE-2021-3748

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.52% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 43.9% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2022-03-23 19:46Z4 YR AGO

Last updated

2024-08-03 17:09Z2 YR AGO

Reserved

2021-08-30

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-416Use After FreeVariant

Data version

5.1

Document digest

e7d43c4617446389a4efbe93e7106fb83c2f72d30a78d9b773a23f2bd6b7a8b2

05 Affected products

VendorProductVersionsPlatforms

n/aQEMU (virtio-net)Affects qemu v0.10.0 and above, Fixed In – v6.2.0-rc0 and above.—

06 References

bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1998514x_refsource_MISC
ubuntu.comhttps://ubuntu.com/security/CVE-2021-3748x_refsource_MISC
github.comhttps://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6x_refsource_MISC
lists.nongnu.orghttps://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.htmlx_refsource_MISC
lists.debian.org[debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security updatehttps://lists.debian.org/debian-lts-announce/2022/04/msg00002.htmlmailing-listx_refsource_MLIST
security.netapp.comhttps://security.netapp.com/advisory/ntap-20220425-0004/x_refsource_CONFIRM
security.gentoo.orgGLSA-202208-27https://security.gentoo.org/glsa/202208-27vendor-advisoryx_refsource_GENTOO
lists.debian.org[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security updatehttps://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlmailing-listx_refsource_MLIST

07 Fixed in

AlmaLinux 8

SLOF
Fixed in 20210217-1.module_el8.6.0+2880+7d9e3703
hivex
Fixed in 1.3.18-23.module_el8.6.0+2880+7d9e3703
hivex-devel
Fixed in 1.3.18-23.module_el8.6.0+2880+7d9e3703
libguestfs
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-appliance
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-bash-completion
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-devel
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-gfs2
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-gobject
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-gobject-devel
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-inspect-icons
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-java
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-java-devel
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-javadoc
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-man-pages-ja
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-man-pages-uk
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-rescue
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-rsync
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-tools
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-tools-c
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-winsupport
Fixed in 8.6-1.module_el8.6.0+2880+7d9e3703
libguestfs-xfs
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libiscsi
Fixed in 1.18.0-8.module_el8.6.0+2880+7d9e3703
libiscsi-devel
Fixed in 1.18.0-8.module_el8.6.0+2880+7d9e3703
libiscsi-utils
Fixed in 1.18.0-8.module_el8.6.0+2880+7d9e3703
libnbd
Fixed in 1.6.0-5.module_el8.6.0+2880+7d9e3703
libnbd-bash-completion
Fixed in 1.6.0-5.module_el8.6.0+2880+7d9e3703
libnbd-devel
Fixed in 1.6.0-5.module_el8.6.0+2880+7d9e3703
libtpms
Fixed in 0.9.1-0.20211126git1ff6fe1f43.module_el8.6.0+2880+7d9e3703
libtpms-devel
Fixed in 0.9.1-0.20211126git1ff6fe1f43.module_el8.6.0+2880+7d9e3703
libvirt
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-client
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-config-network
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-config-nwfilter
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-interface
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-network
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-nodedev
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-nwfilter
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-qemu
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703

90 further packages in AlmaLinux 8 not shown (first 40 listed).

CloudLinux 8

SLOF
Fixed in 20210217-1.module_el8.6.0+2880+7d9e3703
hivex
Fixed in 1.3.18-23.module_el8.6.0+2880+7d9e3703
hivex-devel
Fixed in 1.3.18-23.module_el8.6.0+2880+7d9e3703
libguestfs
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-appliance
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-bash-completion
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-devel
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-gfs2
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-gobject
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-gobject-devel
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-inspect-icons
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-java
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-java-devel
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-javadoc
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-man-pages-ja
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-man-pages-uk
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-rescue
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-rsync
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-tools
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-tools-c
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libguestfs-winsupport
Fixed in 8.6-1.module_el8.6.0+2880+7d9e3703
libguestfs-xfs
Fixed in 1:1.44.0-5.module_el8.6.0+2880+7d9e3703.alma
libiscsi
Fixed in 1.18.0-8.module_el8.6.0+2880+7d9e3703
libiscsi-devel
Fixed in 1.18.0-8.module_el8.6.0+2880+7d9e3703
libiscsi-utils
Fixed in 1.18.0-8.module_el8.6.0+2880+7d9e3703
libnbd
Fixed in 1.6.0-5.module_el8.6.0+2880+7d9e3703
libnbd-bash-completion
Fixed in 1.6.0-5.module_el8.6.0+2880+7d9e3703
libnbd-devel
Fixed in 1.6.0-5.module_el8.6.0+2880+7d9e3703
libtpms
Fixed in 0.9.1-0.20211126git1ff6fe1f43.module_el8.6.0+2880+7d9e3703
libtpms-devel
Fixed in 0.9.1-0.20211126git1ff6fe1f43.module_el8.6.0+2880+7d9e3703
libvirt
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-client
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-config-network
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-config-nwfilter
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-interface
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-network
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-nodedev
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-nwfilter
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703
libvirt-daemon-driver-qemu
Fixed in 8.0.0-5.module_el8.6.0+2880+7d9e3703

90 further packages in CloudLinux 8 not shown (first 40 listed).

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

qemu
Fixed in 1:6.1+dfsg-6

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

qemu
Fixed in 1:6.1+dfsg-6

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

qemu
Fixed in 1:6.1+dfsg-6

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

qemu
Fixed in 1:2.11+dfsg-1ubuntu7.39

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

qemu
Fixed in 1:4.2-3ubuntu6.21

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

qemu
Fixed in 1:6.2+dfsg-2ubuntu5

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.