CVE-2021-20221: 
NixOS vulnerability analysis and mitigation

An out-of-bounds heap buffer access vulnerability (CVE-2021-20221) was discovered in the ARM Generic Interrupt Controller emulator of QEMU up to and including version 4.2.0 on aarch64 platform. The vulnerability was disclosed on February 5, 2021. The issue affects the QEMU emulator when writing an interrupt ID to the controller memory area, as it is not masked to be 4 bits wide (OSS Security).

The vulnerability occurs in the ARM Generic Interrupt Controller emulator when writing an interrupt ID to the controller memory area. The technical issue stems from the interrupt ID not being properly masked to 4 bits wide, which can lead to out-of-bounds heap buffer access while updating controller state fields and their subsequent processing. This vulnerability specifically requires an unusual kernel start-up configuration with 'kernel-irqchip=off' and does not affect the default configuration where kernel-irqchip is set to 'on' (OSS Security). The vulnerability has been assigned a CVSS v3.1 base score of 6.0 (Medium) (Ubuntu Security).

When successfully exploited, this vulnerability could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service (DoS) scenario (OSS Security).

The vulnerability has been fixed in various distributions through security updates. The fix was implemented in QEMU through a patch that properly masks the interrupt ID (OSS Security). For Debian 9 stretch, the fix was included in version 1:2.8+dfsg-6+deb9u13 (Debian LTS).