CVE-2021-3392: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2021-3392) was discovered in the MegaRAID emulator of QEMU versions between 2.10.0 and 5.2.0. The vulnerability was discovered by Cheolwoo Myung of Seoul National University and disclosed in February 2021. The issue affects the SCSI I/O request processing in the mptsas1068 emulator (NVD, Launchpad Bug).

The vulnerability occurs when mptsas_free_request() fails to dequeue the request object 'req' from a pending requests queue in case of an error. This leads to a use-after-free condition in the mptsas_process_scsi_io_request() function. The vulnerability has been assigned a CVSS v3.1 base score of 3.2 (LOW) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L (NVD, NetApp Advisory).

When successfully exploited, this vulnerability allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service (DoS) condition (Launchpad Bug, Red Hat Bugzilla).

The vulnerability requires local access and high privileges to exploit. It affects QEMU installations that include support for the LSI SAS1068 controller emulation (Red Hat Bugzilla).

The vulnerability was fixed in QEMU version 6.0.0 with the upstream patch commit 3791642c8d60029adf9b00bcb4e34d7d8a1aea4d. Various Linux distributions have also released security updates to address this vulnerability in their respective QEMU packages (Debian LTS, Red Hat Bugzilla).