PT-2022-7295 · Libvirt+10 · Libvirt+10

Daniel P. Berrangé · Published 2021-07-27 · Updated 2024-06-15 · CVE-2021-3631

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description The issue is related to the generation of SELinux MCS category pairs for dynamic labels of virtual machines in the libvirt library. This flaw can be exploited by a remote attacker to gain access to confidential information. It allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this issue is to confidentiality and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALSA-2021:4191

ALT-PU-2021-2714

ALT-PU-2021-3364

BDU:2024-02428

CESA-2021_4191

CVE-2021-3631

DLA-3778-1

MGASA-2021-0399

OESA-2021-1385

OPENSUSE-SU-2021:1119-1

OPENSUSE-SU-2021:2812-1

OPENSUSE-SU-2021_1119-1

OPENSUSE-SU-2021_2812-1

OPENSUSE-SU-2024:11008-1

RHSA-2021:3703

RHSA-2021:3704

RHSA-2021:4191

RHSA-2021_4191

RLSA-2021:4191

SUSE-SU-2021:2471-1

SUSE-SU-2021:2812-1

SUSE-SU-2021_2471-1

SUSE-SU-2021_2812-1

USN-5399-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libvirt

References · 106

• 🔥 https://gitlab.com/libvirt/libvirt/-/issues/153 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2021:2812-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3631 · Vendor Advisory
• https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2 · Patch
• https://bdu.fstec.ru/vul/2024-02428 · Security Note
• https://ubuntu.com/security/CVE-2021-3631 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4191 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3631 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1385 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5399-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0399.html · Security Note
• https://linux.oracle.com/errata/ELSA-2022-10062.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2471-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25637 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-12108.html · Vendor Advisory