CVE-2021-3545

An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.

• CWE-908
• CWE-908

• http://www.openwall.com/lists/oss-security/2021/05/31/1Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1958955Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202208-27Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210720-0008/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4980Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/31/1Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1958955Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202208-27Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210720-0008/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4980Third Party Advisory

Published

Jun 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35437SQL injection vulnerability in LMXCMS v.1.4 allows attacker …9.8
• CVE-2021-35438phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets…6.1
• CVE-2021-3544Several memory leaks were found in the virtio vhost-user GPU…6.5
• CVE-2021-35440Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). …6.1
• CVE-2021-35448Emote Interactive Remote Mouse 3.008 on Windows allows attac…7.8
• CVE-2021-35449The Lexmark Universal Print Driver version 2.15.1.0 and belo…7.8
• CVE-2021-35450A Server Side Template Injection in the Entando Admin Consol…7.2
• CVE-2021-35451In Teradici PCoIP Management Console-Enterprise 20.07.0, an …6.1
• CVE-2021-35452An Incorrect Access Control vulnerability exists in libde265…6.5
• CVE-2021-35456Online Pet Shop We App 1.0 is vulnerable to remote SQL injec…9.8
• CVE-2021-35458Online Pet Shop We App 1.0 is vulnerable to Union SQL Inject…9.8
• CVE-2021-3546An out-of-bounds write vulnerability was found in the virtio…8.2