PT-2021-7380 · Libvirt+10 · Libvirt+10

Mauro Matteo Cascella · Published 2021-07-28 · Updated 2025-02-10 · CVE-2021-3667

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

ALSA-2021:4191

ALT-PU-2021-2714

ALT-PU-2021-3364

BDU:2022-05841

CESA-2021_4191

CVE-2021-3667

DLA-3778-1

MGASA-2021-0547

OESA-2021-1385

OPENSUSE-SU-2021:1451-1

OPENSUSE-SU-2021:2812-1

OPENSUSE-SU-2021_1451-1

OPENSUSE-SU-2021_2812-1

OPENSUSE-SU-2024:11008-1

RHSA-2021:3703

RHSA-2021:3704

RHSA-2021:4191

RHSA-2021_4191

RLSA-2021:4191

SUSE-SU-2021:2812-1

SUSE-SU-2021:3277-1

SUSE-SU-2021:3540-1

SUSE-SU-2021:3586-1

SUSE-SU-2021_3277-1

SUSE-SU-2021_3540-1

SUSE-SU-2021_3586-1

USN-5399-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libvirt

References · 119

• https://osv.dev/vulnerability/openSUSE-SU-2021:2812-1 · Vendor Advisory
• https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87 · Patch
• https://advisories.mageia.org/MGASA-2021-0547.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1986094 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3667 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3631 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3667 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4191 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3540-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3277-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1385 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5399-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3667 · Vendor Advisory