CVE-2021-3975

Katalog CVE

CVSS 6.5 · Medium EPSS 1,5%

Kerentanan Use After Free pada redhat libvirt, canonical ubuntu linux +12 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

Rincian

Terbit di NVD

23 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2024326 issue tracking · patch · advisory pihak ketiga
• https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7 patch · advisory pihak ketiga
• https://ubuntu.com/security/CVE-2021-3975 patch · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2021-3975 issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20221201-0002/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html