CVE-2021-3546
📋 TL;DR
This vulnerability allows a privileged guest user in QEMU virtual machines to trigger an out-of-bounds write in the virtio vhost-user GPU device. It can crash the QEMU process on the host (denial of service) or potentially execute arbitrary code with QEMU's privileges. Systems running QEMU with vhost-user-gpu enabled are affected.
💻 Affected Systems
- QEMU
📦 What is this software?
Qemu by Qemu
⚠️ Risk & Real-World Impact
Worst Case
Privileged guest user gains code execution on the host with QEMU process privileges, potentially leading to host compromise.
Likely Case
Privileged guest user crashes the QEMU process, causing denial of service for all VMs on that host.
If Mitigated
If proper isolation and least privilege are implemented, impact is limited to the affected VM and QEMU process.
🎯 Exploit Status
Exploit requires privileged access within guest VM. Proof-of-concept code was published in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: QEMU 6.0.1 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1958978
Restart Required: Yes
Instructions:
1. Update QEMU to version 6.0.1 or later. 2. Stop all affected VMs. 3. Install updated QEMU packages. 4. Restart QEMU service and affected VMs.
🔧 Temporary Workarounds
Disable vhost-user-gpu
allRemove or disable the vhost-user-gpu device from VM configurations
Edit VM configuration to remove '-device vhost-user-gpu' or equivalent GPU passthrough settings
🧯 If You Can't Patch
- Isolate QEMU processes with strict SELinux/AppArmor policies
- Run QEMU with minimal privileges and in separate namespaces
🔍 How to Verify
Check if Vulnerable:
Check if QEMU version is ≤6.0 and vhost-user-gpu is enabled in VM configurationsCheck Version:
qemu-system-x86_64 --versionVerify Fix Applied:
Verify QEMU version is ≥6.0.1 and check VM configurations no longer use vulnerable GPU settings📡 Detection & Monitoring
Log Indicators:
- QEMU process crashes
- Kernel logs showing segmentation faults in QEMU
- VM guest sending VIRTIO_GPU_CMD_GET_CAPSET commands
Network Indicators:
- Unusual virtio-gpu traffic patterns from guest VMs
SIEM Query:
process_name:"qemu-system" AND (event_type:"crash" OR error:"segmentation fault")🔗 References
- http://www.openwall.com/lists/oss-security/2021/05/31/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1958978
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://www.debian.org/security/2021/dsa-4980
- http://www.openwall.com/lists/oss-security/2021/05/31/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1958978
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://www.debian.org/security/2021/dsa-4980
