CVE-2021-3748

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A use-after-free issue was found in the virtio-net device of QEMU. This could occur when the descriptor's address belongs to the non direct access region, due to num buffers being set after the virtqueue element has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.