CVE-2022-0897: Medium severity red hat libvirt-daemon-driver-storage-iscsi-direct vulnerability
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).
Other sources
The virNWFilterObjListNumOfNWFilters method iterates over the driver->nwfilters, accessing virNWFilterObj instances. However, it fails to acquire the driver mutex, thus there is no protection to stop another thread from concurrently modifying the driver->nwfilters object. An unprivileged user could exploit this issue via libvirt API virConnectNumOfNWFilters to crash the libvirtd/virtnwfilterd daemon.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0897?
CVE-2022-0897 is a vulnerability found in the libvirt nwfilter driver that allows concurrent modification of the driver's nwfilters object.
What is the severity of CVE-2022-0897?
CVE-2022-0897 has a severity rating of medium.
How does CVE-2022-0897 affect libvirt?
CVE-2022-0897 affects libvirt by failing to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances, allowing concurrent modification of the driver's nwfilters object.
Which versions of libvirt are affected by CVE-2022-0897?
Versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2, 8.0.0-1ubuntu7.5, and 9.0.0-4 are affected by CVE-2022-0897.
How can CVE-2022-0897 be fixed?
To fix CVE-2022-0897, update libvirt to version 4.0.0-1ubuntu8.21 or later.