CVE-2021-20221

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

• CWE-125
• CWE-787

• http://www.openwall.com/lists/oss-security/2021/02/05/1Mailing List, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1924601Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00024.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210708-0005/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/02/05/1Mailing List, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1924601Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00024.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210708-0005/Third Party Advisory

Published

May 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20216A flaw was found in Privoxy in versions before 3.0.31. A mem…7.5
• CVE-2021-20217A flaw was found in Privoxy in versions before 3.0.31. An as…7.5
• CVE-2021-20218A flaw was found in the fabric8 kubernetes-client in version…7.4
• CVE-2021-20219A denial of service vulnerability was found in n_tty_receive…5.5
• CVE-2021-2022Vulnerability in the MySQL Server product of Oracle MySQL (c…4.4
• CVE-2021-20220A flaw was found in Undertow. A regression in the fix for CV…4.8
• CVE-2021-20222A flaw was found in keycloak. The new account console in key…7.5
• CVE-2021-20223Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20224An integer overflow issue was discovered in ImageMagick's Ex…5.5
• CVE-2021-20225A flaw was found in grub2 in versions prior to 2.06. The opt…6.7
• CVE-2021-20226A use-after-free flaw was found in the io_uring in Linux ker…7.8
• CVE-2021-20227A flaw was found in SQLite's SELECT query functionality (src…5.5