{"id":"CVE-2021-3527","details":"A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.","modified":"2026-04-11T16:26:00.072749Z","published":"2021-05-26T22:15:08.267Z","related":["SUSE-SU-2021:14848-1","SUSE-SU-2021:2789-1","SUSE-SU-2021:2813-1","SUSE-SU-2021:2858-1","SUSE-SU-2021:3575-1","SUSE-SU-2021:3613-1","SUSE-SU-2021:3614-1","SUSE-SU-2021:3635-1","openSUSE-SU-2021:1202-1","openSUSE-SU-2021:2789-1","openSUSE-SU-2021:2858-1","openSUSE-SU-2021:3614-1","openSUSE-SU-2024:11287-1"],"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202208-27"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20210708-0008/"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955695"},{"type":"FIX","url":"https://www.openwall.com/lists/oss-security/2021/05/05/5"},{"type":"FIX","url":"https://gitlab.com/qemu-project/qemu/-/commit/05a40b172e4d691371534828078be47e7fff524c"},{"type":"FIX","url":"https://gitlab.com/qemu-project/qemu/-/commit/7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"0"},{"last_affected":"609d7596524ab204ccd71ef42c9eee4c7c338ea4"},{"introduced":"0"},{"last_affected":"c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4"},{"introduced":"0"},{"last_affected":"c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4"},{"introduced":"0"},{"last_affected":"c25df57ae8f9fe1c72eee2dab37d76d904ac382e"},{"introduced":"0"},{"last_affected":"7c949c53e936aa3a658d84ab53bae5cadaa5d59c"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"6.0.0"},{"introduced":"0"},{"last_affected":"8.0"},{"introduced":"0"},{"last_affected":"8.0"},{"introduced":"0"},{"last_affected":"9.0"},{"introduced":"0"},{"last_affected":"10.0"}]}},{"type":"GIT","repo":"https://gitlab.com/qemu-project/qemu","events":[{"introduced":"0"},{"fixed":"05a40b172e4d691371534828078be47e7fff524c"},{"fixed":"7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986"}]}],"versions":["v0.1.0","v0.1.1","v0.1.3","v0.1.4","v0.1.5","v0.1.6","v0.11.0-rc0","v0.12.0-rc0","v0.13.0-rc0","v0.14.0-rc0","v0.2.0","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.4.3","v0.4.4","v0.5.0","v1.0","v1.0-rc0","v1.0-rc1","v1.0-rc2","v1.0-rc3","v1.0-rc4","v1.1-rc0","v1.1-rc1","v1.1-rc2","v1.1.0","v1.1.0-rc2","v1.1.0-rc3","v1.1.0-rc4","v1.2.0","v1.2.0-rc0","v1.2.0-rc1","v1.2.0-rc2","v1.2.0-rc3","v1.3.0","v1.3.0-rc0","v1.3.0-rc1","v1.3.0-rc2","v1.4.0","v1.4.0-rc0","v1.4.0-rc1","v1.4.0-rc2","v1.5.0","v1.5.0-rc0","v1.5.0-rc1","v1.5.0-rc2","v1.5.0-rc3","v1.6.0","v1.6.0-rc0","v1.6.0-rc1","v1.6.0-rc2","v1.6.0-rc3","v1.7.0","v1.7.0-rc0","v1.7.0-rc1","v1.7.0-rc2","v10.0.0","v10.0.0-rc0","v10.0.0-rc1","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v2.0.0","v2.0.0-rc0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.1.0","v2.1.0-rc0","v2.1.0-rc1","v2.1.0-rc2","v2.1.0-rc3","v2.1.0-rc4","v2.1.0-rc5","v2.10.0","v2.10.0-rc0","v2.10.0-rc1","v2.10.0-rc2","v2.10.0-rc3","v2.10.0-rc4","v2.11.0","v2.11.0-rc0","v2.11.0-rc1","v2.11.0-rc2","v2.11.0-rc3","v2.11.0-rc4","v2.11.0-rc5","v2.12.0","v2.12.0-rc0","v2.12.0-rc1","v2.12.0-rc2","v2.12.0-rc3","v2.12.0-rc4","v2.2.0","v2.2.0-rc0","v2.2.0-rc1","v2.2.0-rc2","v2.2.0-rc3","v2.2.0-rc4","v2.2.0-rc5","v2.3.0","v2.3.0-rc0","v2.3.0-rc1","v2.3.0-rc2","v2.3.0-rc3","v2.3.0-rc4","v2.4.0","v2.4.0-rc0","v2.4.0-rc1","v2.4.0-rc2","v2.4.0-rc3","v2.4.0-rc4","v2.5.0","v2.5.0-rc0","v2.5.0-rc1","v2.5.0-rc2","v2.5.0-rc3","v2.5.0-rc4","v2.6.0","v2.6.0-rc0","v2.6.0-rc1","v2.6.0-rc2","v2.6.0-rc3","v2.6.0-rc4","v2.6.0-rc5","v2.7.0","v2.7.0-rc0","v2.7.0-rc1","v2.7.0-rc2","v2.7.0-rc3","v2.7.0-rc4","v2.7.0-rc5","v2.8.0","v2.8.0-rc0","v2.8.0-rc1","v2.8.0-rc2","v2.8.0-rc3","v2.8.0-rc4","v2.9.0","v2.9.0-rc0","v2.9.0-rc1","v2.9.0-rc2","v2.9.0-rc3","v2.9.0-rc4","v2.9.0-rc5","v3.0.0","v3.0.0-rc0","v3.0.0-rc1","v3.0.0-rc2","v3.0.0-rc3","v3.0.0-rc4","v3.1.0","v3.1.0-rc0","v3.1.0-rc1","v3.1.0-rc2","v3.1.0-rc3","v3.1.0-rc4","v3.1.0-rc5","v4.0.0","v4.0.0-rc0","v4.0.0-rc1","v4.0.0-rc2","v4.0.0-rc3","v4.0.0-rc4","v4.1.0","v4.1.0-rc0","v4.1.0-rc1","v4.1.0-rc2","v4.1.0-rc3","v4.1.0-rc4","v4.1.0-rc5","v4.2.0","v4.2.0-rc0","v4.2.0-rc1","v4.2.0-rc2","v4.2.0-rc3","v4.2.0-rc4","v4.2.0-rc5","v5.0.0","v5.0.0-rc0","v5.0.0-rc1","v5.0.0-rc2","v5.0.0-rc3","v5.0.0-rc4","v5.1.0","v5.1.0-rc0","v5.1.0-rc1","v5.1.0-rc2","v5.1.0-rc3","v5.2.0","v5.2.0-rc0","v5.2.0-rc1","v5.2.0-rc2","v5.2.0-rc3","v5.2.0-rc4","v6.0.0","v6.0.0-rc0","v6.0.0-rc1","v6.0.0-rc2","v6.0.0-rc3","v6.0.0-rc4","v6.0.0-rc5","v6.1.0","v6.1.0-rc0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.2.0","v6.2.0-rc0","v6.2.0-rc1","v6.2.0-rc3","v6.2.0-rc4","v7.0.0","v7.0.0-rc0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.2.0","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v8.0.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v8.0.0-rc3","v8.0.0-rc4","v8.1.0","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v8.1.0-rc3","v8.1.0-rc4","v8.2.0","v8.2.0-rc0","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v9.0.0","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v9.1.0","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.2.0","v9.2.0-rc0","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3"],"database_specific":{"vanir_signatures":[{"target":{"file":"hw/usb/combined-packet.c"},"source":"https://gitlab.com/qemu-project/qemu@05a40b172e4d691371534828078be47e7fff524c","deprecated":false,"id":"CVE-2021-3527-4cab5e44","digest":{"threshold":0.9,"line_hashes":["269400761726207554090353202840902315257","119307344340641259751801519692907203016","326548559512027486046572904986022376072","73041713572673512055747119237799287705"]},"signature_type":"Line","signature_version":"v1"},{"target":{"file":"hw/usb/redirect.c"},"source":"https://gitlab.com/qemu-project/qemu@7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986","deprecated":false,"id":"CVE-2021-3527-503e3bf1","digest":{"threshold":0.9,"line_hashes":["167443947742219700222957101252243774600","61911157104635718831387678215906986250","29568767801218084532825511420516210099","88460353428432787954060144963198367115","293827903315787450183182877461871256600","90873833699346552304369370712175299809","37900396691202462739205124391483260441","242002003889685031535552614557524308098","51051223527711322627583931772797510787","210975785683925942205039452318950435298","108317851574551643512430908095355764785","83811626812010732757727657331821254659"]},"signature_type":"Line","signature_version":"v1"},{"target":{"function":"usbredir_handle_iso_data","file":"hw/usb/redirect.c"},"source":"https://gitlab.com/qemu-project/qemu@7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986","deprecated":false,"id":"CVE-2021-3527-7596b36c","digest":{"length":3283,"function_hash":"193074547064934338397412369714946632047"},"signature_type":"Function","signature_version":"v1"},{"target":{"function":"usbredir_handle_interrupt_out_data","file":"hw/usb/redirect.c"},"source":"https://gitlab.com/qemu-project/qemu@7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986","deprecated":false,"id":"CVE-2021-3527-adb2a197","digest":{"length":523,"function_hash":"166676994960784205671750699193853905376"},"signature_type":"Function","signature_version":"v1"},{"target":{"function":"usb_ep_combine_input_packets","file":"hw/usb/combined-packet.c"},"source":"https://gitlab.com/qemu-project/qemu@05a40b172e4d691371534828078be47e7fff524c","deprecated":false,"id":"CVE-2021-3527-b2c39117","digest":{"length":1311,"function_hash":"249538098380142255455224067407001734942"},"signature_type":"Function","signature_version":"v1"},{"target":{"function":"usbredir_handle_bulk_data","file":"hw/usb/redirect.c"},"source":"https://gitlab.com/qemu-project/qemu@7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986","deprecated":false,"id":"CVE-2021-3527-d8d1898b","digest":{"length":1398,"function_hash":"198368438371595159633120831886524687622"},"signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-04-11T16:26:00Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3527.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}