CVE-2021-3559: Buffer Overflow
A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices (e.g., GRID driver). This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt daemon by executing the 'nodedev-list' virsh command. The highest threat from this vulnerability is to system availability.
Other sources
The virsh nodedev-list command may cause libvirt to crash on hosts with GRID driver installed. The flaw exists in the virConnectListAllNodeDevices API. This issue could be used by an unprivileged user with a read-only connection to perform a denial of service attack by leveraging the virConnectListAllNodeDevices API via nodedev-list.
Fixed upstream in libvirt-v7.0.0: https://gitlab.com/libvirt/libvirt/-/commit/4c4d0e2da07b5a035b26a0ff13ec27070f7c7b1a
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libvirtto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
libvirtto a version that resolves this vulnerability.Fixed in 7.0.0 - Compensating control
Mitigate by preventing unprivileged read-only clients from invoking virsh 'nodedev-list' (which uses the virConnectListAllNodeDevices API) on hosts with mediated-device-capable PCI drivers (e.g., GRID).
- Operational
If the libvirt daemon may have crashed, restart/verify the libvirt daemon after upgrading to libvirt 7.0.0 (especially on hosts with a GRID driver installed).
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw in libvirt?
The vulnerability ID of this flaw in libvirt is CVE-2021-3559.
What is the affected software?
The affected software includes Redhat Libvirt and NetApp ONTAP Select Deploy administration utility.
What is the severity of CVE-2021-3559?
The severity of CVE-2021-3559 is medium (CVSS score: 6.5).
How does CVE-2021-3559 affect hosts with a PCI device and driver?
CVE-2021-3559 only affects hosts with a PCI device and driver that supports mediated devices (e.g., GRID driver).
How can an unprivileged client exploit CVE-2021-3559?
An unprivileged client with a read-only connection can use CVE-2021-3559 to crash the libvirt daemon.