CVE-2021-3975
—CVSS 3.1
6.5 medium
EPSS
2%p73
Published
()
Modified
Description
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
- Vendors
- redhatcanonicalfedoraprojectdebiannetapp
- Products
- libvirt, ubuntu linux, fedora, enterprise linux, enterprise linux eus, enterprise linux for ibm z systems, enterprise linux for ibm z systems eus, enterprise linux for power little endian, enterprise linux for power little endian eus, enterprise linux server for power little endian update services for sap solutions, enterprise linux server tus, codeready linux builder
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.