Use-after-free in libvirt - CVE-2021-3975

Vulnerability identifier: #VU58358

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3975

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in the qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF. An unprivileged client with a read-only connection can trigger the use-after-free error by calling the virConnectGetAllDomainStats API and crash the application.

libvirt
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
Ubuntu
openEuler
Red Hat Enterprise Linux Advanced Virtualization
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-nwfilter-debuginfo
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-nodedev-debuginfo
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-network-debuginfo
libvirt-daemon-driver-network
libvirt-daemon-driver-lxc-debuginfo
libvirt-daemon-driver-lxc
libvirt-daemon-driver-libxl-debuginfo
libvirt-daemon-driver-libxl
libvirt-daemon-driver-interface-debuginfo
libvirt-daemon-driver-interface
libvirt-daemon-debuginfo
libvirt-doc
libvirt-daemon-config-network
libvirt-daemon
libvirt-client-debuginfo
libvirt-client
libvirt-admin-debuginfo
libvirt-admin
libvirt
libvirt-libs
libvirt-libs-debuginfo
libvirt-lock-sanlock
libvirt-lock-sanlock-debuginfo
libvirt-nss
libvirt-nss-debuginfo
libvirt-daemon-driver-storage-mpath
libvirt-debugsource
libvirt-daemon-xen
libvirt-daemon-qemu
libvirt-daemon-lxc
libvirt-daemon-driver-qemu
libvirt-daemon-hooks
libvirt-daemon-driver-storage-scsi-debuginfo
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-rbd-debuginfo
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-mpath-debuginfo
libvirt-daemon-driver-storage-logical-debuginfo
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-debuginfo
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-disk-debuginfo
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core-debuginfo
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret-debuginfo
libvirt-daemon-driver-secret
libvirt-daemon-driver-qemu-debuginfo
libvirt0 (Ubuntu package)
libvirt-daemon (Ubuntu package)
libvirt-daemon-system (Ubuntu package)
libvirt-devel
libvirt-bash-completion
libvirt-daemon-kvm
libvirt-debuginfo
libvirt-docs
libvirt-wireshark
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-iscsi-direct

Install updates from vendor's website.

libvirt - update to 7.1.0
libvirt-daemon-config-nwfilter - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-nwfilter-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-nwfilter - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-nodedev-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-nodedev - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-network-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-network - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-lxc-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-lxc - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-libxl-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-libxl - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-interface-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-interface - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-doc - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-config-network - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-client-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-client - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-admin-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-admin - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-libs - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-libs-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-lock-sanlock - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-lock-sanlock-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-nss - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-nss-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-mpath - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-debugsource - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-xen - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-qemu - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-lxc - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-qemu - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-hooks - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-scsi-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-scsi - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-rbd-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-rbd - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-mpath-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-logical-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-logical - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-iscsi-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-iscsi - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-disk-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-disk - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-core-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-core - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-secret-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-secret - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-qemu-debuginfo - addressed in versions 3.3.0-5.49.1, 4.0.0-8.26.1, 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt0 (Ubuntu package) - addressed in versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2
libvirt-daemon (Ubuntu package) - addressed in versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2
libvirt-daemon-system (Ubuntu package) - addressed in versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2
libvirt-devel - addressed in versions 4.0.0-9.40.1, 5.1.0-13.28.2, 5.1.0-17.1, 6.0.0-13.24.1
libvirt-bash-completion - addressed in versions 5.1.0-17.1, 6.0.0-13.24.1
libvirt-daemon-driver-storage-core - update to 6.2.0-16
libvirt-daemon-kvm - update to 6.2.0-16
libvirt-daemon - update to 6.2.0-16
libvirt-admin - update to 6.2.0-16
libvirt-daemon-config-nwfilter - update to 6.2.0-16
libvirt-daemon-driver-secret - update to 6.2.0-16
libvirt-devel - update to 6.2.0-16
libvirt-daemon-driver-storage-disk - update to 6.2.0-16
libvirt-daemon-driver-storage-iscsi - update to 6.2.0-16
libvirt-daemon-driver-storage-logical - update to 6.2.0-16
libvirt-daemon-config-network - update to 6.2.0-16
libvirt-bash-completion - update to 6.2.0-16
libvirt-daemon-driver-nwfilter - update to 6.2.0-16
libvirt-debuginfo - update to 6.2.0-16
libvirt-docs - update to 6.2.0-16
libvirt-daemon-driver-nodedev - update to 6.2.0-16
libvirt-nss - update to 6.2.0-16
libvirt-wireshark - update to 6.2.0-16
libvirt-daemon-driver-storage-gluster - update to 6.2.0-16
libvirt - update to 6.2.0-16
libvirt-daemon-driver-qemu - update to 6.2.0-16
libvirt-daemon-driver-network - update to 6.2.0-16
libvirt-libs - update to 6.2.0-16
libvirt-daemon-driver-storage-rbd - update to 6.2.0-16
libvirt-lock-sanlock - update to 6.2.0-16
libvirt-daemon-qemu - update to 6.2.0-16
libvirt-debugsource - update to 6.2.0-16
libvirt-daemon-driver-storage - update to 6.2.0-16
libvirt-daemon-driver-storage-scsi - update to 6.2.0-16
libvirt-daemon-driver-interface - update to 6.2.0-16
libvirt-daemon-driver-storage-mpath - update to 6.2.0-16
libvirt-client - update to 6.2.0-16
libvirt-daemon-driver-storage-iscsi-direct - update to 6.2.0-16

• https://bugzilla.redhat.com/show_bug.cgi?id=2024326

• Denial of service in libvirt
• Red Hat Enterprise Linux Advanced Virtualization 8 update for the virt:av module
• Ubuntu update for libvirt
• SUSE update for libvirt
• SUSE update for libvirt
• SUSE update for libvirt
• SUSE update for libvirt
• SUSE update for libvirt
• SUSE update for libvirt
• SUSE update for libvirt
• openEuler update for libvirt