USN-5399-1: libvirt vulnerabilities
It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3667) It was discovered that libvirt incorrectly handled threads during shutdown. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3975) It was discovered that libvirt incorrectly handled the libxl driver. An attacker inside a guest could possibly use this issue to cause libvirtd to crash or stop responding, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2021-4147) It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2022-0897) It was discovered that libvirt incorrectly handled the polkit access control driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-25637) It was discovered that libvirt incorrectly generated SELinux labels. In environments using SELinux, this issue could allow the sVirt confinement to be bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3631)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is USN-5399-1.
What is the severity of USN-5399-1?
The severity of USN-5399-1 is not mentioned in the description.
How does the vulnerability CVE-2021-3667 impact libvirt?
The vulnerability CVE-2021-3667 could allow a local attacker to cause libvirt to stop accepting connections, resulting in a denial of service.
How can I fix the vulnerability in libvirt-daemon?
To fix the vulnerability in libvirt-daemon, update to version 7.6.0-0ubuntu1.2 or later.
Where can I find more information about these vulnerabilities?
You can find more information about these vulnerabilities in the references provided: [CVE-2021-3631](https://ubuntu.com/security/CVE-2021-3631), [CVE-2020-25637](https://ubuntu.com/security/CVE-2020-25637), [CVE-2021-4147](https://ubuntu.com/security/CVE-2021-4147).