PT-2021-4071 · Libvirt+1 · Libvirt+1

Mauro Matteo Cascella · Published 2021-01-09 · Updated 2022-04-26 · CVE-2021-3559

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 7.0.0

Description The issue is related to a buffer overflow in the libvirt library's virConnectListAllNodeDevices API when using the GRID driver. This could allow a remote attacker to cause a denial of service by executing the 'nodedev-list' virsh command. The threat primarily affects system availability, particularly on hosts with a PCI device and a driver that supports mediated devices, such as the GRID driver.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the virConnectListAllNodeDevices API or the 'nodedev-list' virsh command to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2021-1059

BDU:2021-04612

CVE-2021-3559

Affected Products

Alt Linux

Libvirt

References · 10

• https://bdu.fstec.ru/vul/2021-04612 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3559 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3559 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1962306 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3559 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3559 · Security Note
• https://ubuntu.com/security/CVE-2021-3559 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210706-0006 · Note
• https://gitlab.com/libvirt/libvirt/-/commit/4c4d0e2da07b5a035b26a0ff13ec27070f7c7b1a · Note