CVE-2021-3947 in QEMU
Summary
by MITRE • 02/18/2022
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/02/2026
The vulnerability under consideration represents a critical stack-based buffer overflow within the QEMU virtualization platform, specifically affecting the NVME (Non-Volatile Memory Express) subsystem. This flaw exists in the nvme_changed_nslist() function which handles namespace list changes within the NVME controller implementation. The issue arises from insufficient bounds checking when processing guest-controlled input parameters that define namespace configurations. Attackers can exploit this vulnerability by crafting malicious input data that triggers an out-of-bounds memory read operation, allowing them to access memory locations beyond the allocated buffer boundaries. The vulnerability is particularly concerning because it operates within the virtualization layer where guest operating systems have direct control over hardware emulation components, creating a potential attack vector that transcends traditional security boundaries.
The technical implementation of this flaw demonstrates poor input validation practices within QEMU's NVME controller emulation code. When processing namespace list changes, the nvme_changed_nslist() function fails to properly validate array indices or buffer limits before accessing guest-provided data structures. This allows a malicious guest operating system to manipulate input parameters such as namespace identifiers or list sizes in ways that cause the function to read memory beyond its intended bounds. The flaw is classified as a CWE-121 stack-based buffer overflow, which represents a well-known vulnerability pattern where insufficient boundary checks enable attackers to overwrite adjacent memory locations or read sensitive data from memory regions. The operational impact of this vulnerability extends beyond simple information disclosure, as it can potentially lead to privilege escalation or denial of service conditions within the virtualized environment.
From an attack perspective, this vulnerability enables malicious users to perform information disclosure attacks against the host system through the guest operating system's control over QEMU's NVME emulation. The attacker would need to have access to a running guest VM that utilizes NVME storage devices and must be able to manipulate namespace list configuration parameters. This type of attack aligns with ATT&CK technique T1059 which involves executing malicious code through command injection or memory corruption techniques. The vulnerability's exploitation potential is heightened because QEMU operates at a privileged level within the host system, meaning that guest-controlled memory access can potentially translate into host-level information leaks or even arbitrary code execution in severe cases. Organizations running virtualized environments with NVME storage configurations are particularly at risk as this flaw exists in widely deployed virtualization infrastructure components.
The recommended mitigation strategies include immediate deployment of QEMU patches addressing the specific buffer overflow in the nvme_changed_nslist() function, which would involve implementing proper bounds checking and input validation mechanisms. System administrators should also consider implementing network segmentation and access controls to limit guest VM privileges when running systems with NVME storage capabilities. Additionally, monitoring for anomalous namespace list change operations could help detect potential exploitation attempts. Organizations should conduct comprehensive vulnerability assessments of their virtualization environments to identify other potentially affected components and ensure that all QEMU installations are updated to versions containing the relevant security fixes. The vulnerability demonstrates the importance of rigorous input validation in virtualization platforms where guest operating systems can directly influence hardware emulation behavior, making it essential for security teams to maintain awareness of such low-level infrastructure vulnerabilities.