{
  "threat_severity" : "Low",
  "public_date" : "2021-07-21T00:00:00Z",
  "bugzilla" : {
    "description" : "libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API",
    "id" : "1986094",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1986094"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-667",
  "details" : [ "An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.", "An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability." ],
  "statement" : "This flaw affects all versions of `libvirt` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this issue.",
  "affected_release" : [ {
    "product_name" : "Advanced Virtualization for RHEL 8.2.1",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3704",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt:8.2-8020120210917153657.863bb0db"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.2.1",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3704",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt-devel:8.2-8020120210917153657.863bb0db"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.4.0.Z",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3703",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.4::el8",
    "package" : "virt:av-8040020210922084349.522a0ee4"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.4.0.Z",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3703",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.4::el8",
    "package" : "virt-devel:av-8040020210922084349.522a0ee4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-11-09T00:00:00Z",
    "advisory" : "RHSA-2021:4191",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt-devel:rhel-8050020211001230723.b4937e53"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-11-09T00:00:00Z",
    "advisory" : "RHSA-2021:4191",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt:rhel-8050020211001230723.b4937e53"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "libvirt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "libvirt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:8.2/libvirt",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Fix deferred",
    "package_name" : "virt:8.3/libvirt",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:av/libvirt",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "libvirt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-3667\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-3667" ],
  "name" : "CVE-2021-3667",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}