CVE-2021-3975: Use After Free
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
Other sources
A use-after-free flaw was found in qemuProcessHandleMonitorEOF() within src/qemu/qemuprocess.c, here qemuMonitorUnregister() is called using multiple threads without being adequately protected by a monitor lock. This issue could be used by a unprivileged user to perform a denial of service attack by causing segmentation fault on libvirt
Fixed upstream in libvirt: https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libvirtto a version that resolves this vulnerability.Fixed in 7.1.0 - Upgrade
Upgrade
debian/libvirtto a version that resolves this vulnerability.Fixed in 7.0.0-3+deb11u3Fixed in 9.0.0-4+deb12u2Fixed in 11.3.0-3+deb13u2Fixed in 12.0.0-1
Event History
Frequently Asked Questions
What is CVE-2021-3975?
CVE-2021-3975 is a use-after-free vulnerability found in libvirt.
What is the severity of CVE-2021-3975?
The severity of CVE-2021-3975 is medium with a CVSS score of 6.5.
How does CVE-2021-3975 affect libvirt?
CVE-2021-3975 affects libvirt by allowing an attacker to trigger a use-after-free flaw, potentially leading to arbitrary code execution or a denial of service.
How can I fix CVE-2021-3975?
To fix CVE-2021-3975, update libvirt to version 7.1.0 or later.
Where can I find more information about CVE-2021-3975?
You can find more information about CVE-2021-3975 on the Red Hat Security Advisory and the GitHub commit linked in the references.