Back
CVE-2021-3592
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input()…
Low3.8EPSS 0.33%
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Low3.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (7 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.8.
Weakness
Affected products
QEMU
- affected libslirp 4.6.0
References (8)
- https://bugzilla.redhat.com/show_bug.cgi?id=1970484 (opens in a new tab)x_transferred
- FEDORA-2021-71de23bedd (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2021-7cd749f133 (opens in a new tab)vendor-advisoryx_transferred
- GLSA-202107-44 (opens in a new tab)vendor-advisoryx_transferred
- https://security.netapp.com/advisory/ntap-20210805-0004/ (opens in a new tab)x_transferred
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update (opens in a new tab)mailing-listx_transferred
- [debian-lts-announce] 20210911 [SECURITY] [DLA 2753-2] qemu regression update (opens in a new tab)mailing-listx_transferred
- [debian-lts-announce] 20230314 [SECURITY] [DLA 3362-1] qemu security update (opens in a new tab)mailing-listx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-3592)Record last updated .