Read the docs
TI-2021-03029 Aliases CVE-2021-4158GHSA-9p4w-6fpq-fpm6

NULL pointer dereference in QEMU

Priority LOW 27CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

Why it matters now

EPSS 0.00399 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—QEMUAffects v6.0.0 and above.—No fix listedCNA
  • QEMU Vendor— Affected Affects v6.0.0 and above. Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*6.0.0 to before 7.0.0VulnerableQEMU
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions 6.0.0 to before 7.0.0 Vulnerable ·QEMU
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2022:7967 Released 2022-11-15 · Red Hat rating Moderate
    qemu-kvm security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) qemu-guest-agent-17:7.0.0-13.el9, qemu-img-17:7.0.0-13.el9, qemu-kvm-17:7.0.0-13.el9 +19
  • RHSA-2022:1759 Released 2022-05-10 · Red Hat rating Moderate
    virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.noarch::virt:rhel, SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.src::virt:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64::virt:rhel +47
    • Red Hat Enterprise Linux CRB (v. 8) SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.src::virt-devel:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686::virt-devel:rhel, hivex-devel-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686::virt-devel:rhel +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8 Advanced VirtualizationAffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:1759
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:7967
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2022:1759
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8 Advanced Virtualization

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4158
  2. 2026-10-03 Alias added: GHSA-9p4w-6fpq-fpm6

References

Exploit 1

Patch 3

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences