CVE-2021-3667

2022-03-0200:00:00

CWE-667

redhat

www.cve.org

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.4%

JSON

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libvirt",
    "versions": [
      {
        "version": "Fixedin - libvert v7.6.0-rc1 and above",
        "status": "affected"
      }
    ]
  }
]