medium6.5
CVE-2021-3975
A use-after-free flaw was found in libvirt.
Impact
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Libvirt | before 7.1.0 |
| Canonical | Ubuntu Linux | Version 21.10 |
| Fedoraproject | Fedora | Version 35 |
| Redhat | Enterprise Linux | Version 8.0 |
| Redhat | Enterprise Linux Eus | Version 8.6 |
| Redhat | Enterprise Linux For Ibm Z Systems | Version 8.0 |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | Version 8.6 |
| Redhat | Enterprise Linux For Power Little Endian | Version 8.0 |
| Redhat | Enterprise Linux For Power Little Endian Eus | Version 8.6 |
| Redhat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | Version 8.6 |
| Redhat | Enterprise Linux Server Tus | Version 8.6 |
| Redhat | Codeready Linux Builder | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/security/cve/CVE-2021-3975
- https://bugzilla.redhat.com/show_bug.cgi?id=2024326
- https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://security.netapp.com/advisory/ntap-20221201-0002/
- https://ubuntu.com/security/CVE-2021-3975
- https://access.redhat.com/security/cve/CVE-2021-3975
- https://bugzilla.redhat.com/show_bug.cgi?id=2024326
- https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://security.netapp.com/advisory/ntap-20221201-0002/
- https://ubuntu.com/security/CVE-2021-3975