CVE-2021-3608: 
NixOS vulnerability analysis and mitigation

CVE-2021-3608 is a vulnerability discovered in QEMU's implementation of VMWare's paravirtual RDMA device. The vulnerability was identified in the pvrdmaringinit() function within hw/rdma/vmw/pvrdmadevring.c and affects QEMU versions prior to 6.1.0. The issue was disclosed and patched in June 2021 (Bugzilla Report, QEMU Patch).

The vulnerability stems from improper initialization of the 'ring->pages' array in the pvrdmaringinit() function. When handling a 'PVRDMAREGDSRHIGH' write from the guest, rdmapcidma_unmap() may be passed an uninitialized pointer as an argument. The vulnerability has been assigned a CVSS score of 3.2 (LOW) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L (NetApp Advisory).

The vulnerability could lead to undefined behavior and potentially cause the QEMU process to crash on the host, resulting in a denial of service (DoS) condition (Bugzilla Report).

The vulnerability was fixed in QEMU version 6.1.0 by modifying the ring initialization error flow. The fix involves using gmalloc0 instead of gmalloc to ensure proper initialization of memory. Various Linux distributions have released security updates to address this vulnerability, including Ubuntu, Debian, and Red Hat (Ubuntu Notice, Debian Notice).