CVE-2021-3507: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability (CVE-2021-3507) was discovered in the floppy disk emulator of QEMU versions up to 6.0.0. The vulnerability was discovered by Alexander Bulekov and disclosed on May 6, 2021. The issue affects the floppy disk emulation functionality in QEMU's fdctrltransferhandler() function within hw/block/fdc.c (Ubuntu Security, Red Hat Bugzilla).

The vulnerability occurs while processing DMA read data transfers from the floppy drive to the guest system. The data length is not properly computed or sanitized while processing DMA read data transfers from the floppy drive, specifically while handling a VERIFY command. This leads to a negative value being used as the data length in fdctrltransferhandler(), which is eventually used in a memcpy operation in flatviewwritecontinue() (Red Hat Bugzilla).

When successfully exploited, this vulnerability could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service (DoS) scenario, or potentially lead to information leakage from the host memory (Red Hat Bugzilla, NetApp Security).

The issue has been fixed in upstream QEMU through commits by Philippe and Kevin. The fix was merged into the QEMU project repository. Various Linux distributions have released security updates to address this vulnerability, including Ubuntu, Red Hat Enterprise Linux 8 and 9, and Debian (Red Hat Bugzilla, Ubuntu Security).