CVE-2021-3975

2022-08-2300:00:00

CWE-416

redhat

www.cve.org

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.9%

JSON

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libvirt",
    "versions": [
      {
        "version": "Fixed in libvirt v7.1.0",
        "status": "affected"
      }
    ]
  }
]