{"schema_version":"1.7.5","id":"CVE-2021-3682","published":"2021-08-05T20:15:09.963Z","modified":"2026-07-08T06:02:37.203934686Z","related":["SUSE-SU-2021:14848-1","SUSE-SU-2021:2789-1","SUSE-SU-2021:2813-1","SUSE-SU-2021:2858-1","SUSE-SU-2021:3575-1","SUSE-SU-2021:3613-1","SUSE-SU-2021:3614-1","SUSE-SU-2021:3635-1","openSUSE-SU-2021:1202-1","openSUSE-SU-2021:2789-1","openSUSE-SU-2021:2858-1","openSUSE-SU-2021:3614-1","openSUSE-SU-2024:11287-1"],"details":"A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"0"},{"fixed":"f9baca549e44791be0dd98de15add3d8452a8af0"},{"introduced":"f2da205cb4142259d9bc6b9d4596ebbe2426fe49"},{"last_affected":"f2da205cb4142259d9bc6b9d4596ebbe2426fe49"}],"database_specific":{"cpe":["cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*","cpe:2.3:a:qemu:qemu:6.1.0:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"6.1.0"},{"introduced":"6.1.0-rc1"},{"last_affected":"6.1.0-rc1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["6.1.0-rc1","v6.1.0-rc4","v6.1.0-rc3","v6.1.0-rc2","v6.1.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3682.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.com/qemu-project/qemu","events":[{"introduced":"0"},{"fixed":"f9baca549e44791be0dd98de15add3d8452a8af0"},{"introduced":"f2da205cb4142259d9bc6b9d4596ebbe2426fe49"},{"last_affected":"f2da205cb4142259d9bc6b9d4596ebbe2426fe49"}],"database_specific":{"cpe":["cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*","cpe:2.3:a:qemu:qemu:6.1.0:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"6.1.0"},{"introduced":"6.1.0-rc1"},{"last_affected":"6.1.0-rc1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["6.1.0-rc1","v6.1.0-rc4","v6.1.0-rc3","v6.1.0-rc2","v6.1.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3682.json"}}],"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202208-27"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20210902-0006/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4980"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989651"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"11.0"},{"last_affected":"11.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*","cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}