CVE-2021-3975: Use After Free
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
Other sources
A use-after-free flaw was found in qemuProcessHandleMonitorEOF() within src/qemu/qemuprocess.c, here qemuMonitorUnregister() is called using multiple threads without being adequately protected by a monitor lock. This issue could be used by a unprivileged user to perform a denial of service attack by causing segmentation fault on libvirt
Fixed upstream in libvirt: https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3975?
CVE-2021-3975 is a use-after-free vulnerability found in libvirt.
What is the severity of CVE-2021-3975?
The severity of CVE-2021-3975 is medium with a CVSS score of 6.5.
How does CVE-2021-3975 affect libvirt?
CVE-2021-3975 affects libvirt by allowing an attacker to trigger a use-after-free flaw, potentially leading to arbitrary code execution or a denial of service.
How can I fix CVE-2021-3975?
To fix CVE-2021-3975, update libvirt to version 7.1.0 or later.
Where can I find more information about CVE-2021-3975?
You can find more information about CVE-2021-3975 on the Red Hat Security Advisory and the GitHub commit linked in the references.