CVE-2021-3975

Опубликовано: 23 авг. 2022

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

Ссылки

https://access.redhat.com/security/cve/CVE-2021-3975
Issue Tracking
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2024326
Issue Tracking
Patch
Third Party Advisory
https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
https://security.netapp.com/advisory/ntap-20221201-0002/
Third Party Advisory
https://ubuntu.com/security/CVE-2021-3975
Patch
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-3975
Issue Tracking
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2024326
Issue Tracking
Patch
Third Party Advisory
https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
https://security.netapp.com/advisory/ntap-20221201-0002/
Third Party Advisory
https://ubuntu.com/security/CVE-2021-3975
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*

Версия до 7.1.0 (исключая)

Конфигурация 2

cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 7

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00251

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-416

Связанные уязвимости

CVE-2021-3975

CVSS3: 6.5

ubuntu

почти 3 года назад

CVE-2021-3975

CVSS3: 5.3

redhat

больше 3 лет назад

CVE-2021-3975

CVSS3: 6.5

msrc

почти 3 года назад

Описание отсутствует

CVE-2021-3975

CVSS3: 6.5

debian

почти 3 года назад

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister( ...

GHSA-pg89-46xq-98vv

CVSS3: 6.5

github

почти 3 года назад

EPSS

Процентиль: 48%

0.00251

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-416