CVE-2021-3667

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3667
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3667.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3667
Downstream
CLSA (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (3)
RHSA (3)
RLSA (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (1)
openSUSE (3)
SUSE (4)
Published
2022-03-02T23:15:08Z
Modified
2026-07-09T05:44:43Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux"
        }
    ]
}
References

Affected packages

Git / github.com/libvirt/libvirt

Affected ranges

Type
GIT
Repo
https://github.com/libvirt/libvirt
Events
Introduced
6b59754bfda9477586a75af0c0b9ce1036c414e8
Last Affected
03eadc86fc5cdadbc4ab18123d820b6e4e321abd
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "4.1.0"
        },
        {
            "last_affected":  "7.5.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

Other
CVE-2018-1064
CVE-2019-10132
CVE-2019-10161
CVE-2019-10166
CVE-2019-10167
CVE-2019-10168
CVE-2019-3886
CVE-2020-14339
CVE-2020-25637
CVE-2021-3631
v4.*
v4.1.0
v4.10.0
v4.10.0-rc1
v4.10.0-rc2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.5.0
v4.5.0-rc1
v4.5.0-rc2
v4.6.0
v4.6.0-rc1
v4.6.0-rc2
v4.7.0
v4.7.0-rc1
v4.7.0-rc2
v4.8.0
v4.8.0-rc1
v4.8.0-rc2
v4.9.0
v4.9.0-rc1
v5.*
v5.0.0
v5.0.0-rc1
v5.0.0-rc2
v5.1.0
v5.1.0-rc1
v5.1.0-rc2
v5.10.0
v5.10.0-rc1
v5.10.0-rc2
v5.2.0
v5.2.0-rc1
v5.2.0-rc2
v5.3.0
v5.3.0-rc1
v5.3.0-rc2
v5.4.0
v5.4.0-rc1
v5.4.0-rc2
v5.5.0
v5.5.0-rc1
v5.5.0-rc2
v5.6.0
v5.6.0-rc1
v5.6.0-rc2
v5.7.0
v5.7.0-rc1
v5.7.0-rc2
v5.8.0
v5.8.0-rc1
v5.8.0-rc2
v5.9.0
v5.9.0-rc1
v6.*
v6.0.0
v6.0.0-rc1
v6.0.0-rc2
v6.1.0
v6.1.0-rc1
v6.1.0-rc2
v6.10.0
v6.10.0-rc1
v6.10.0-rc2
v6.2.0
v6.2.0-rc1
v6.3.0
v6.3.0-rc1
v6.4.0
v6.4.0-rc1
v6.5.0
v6.5.0-rc1
v6.5.0-rc2
v6.6.0
v6.6.0-rc1
v6.7.0
v6.7.0-rc1
v6.7.0-rc2
v6.8.0
v6.8.0-rc1
v6.8.0-rc2
v6.9.0
v6.9.0-rc1
v6.9.0-rc2
v7.*
v7.0.0
v7.0.0-rc1
v7.0.0-rc2
v7.1.0
v7.1.0-rc1
v7.1.0-rc2
v7.2.0
v7.2.0-rc1
v7.2.0-rc2
v7.3.0
v7.3.0-rc1
v7.3.0-rc2
v7.4.0
v7.4.0-rc1
v7.4.0-rc2
v7.5.0
v7.5.0-rc1
v7.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3667.json"

Git / gitlab.com/libvirt/libvirt

Affected ranges

Type
GIT
Repo
https://gitlab.com/libvirt/libvirt
Events
Introduced
6b59754bfda9477586a75af0c0b9ce1036c414e8
Last Affected
03eadc86fc5cdadbc4ab18123d820b6e4e321abd
Fixed
447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "4.1.0"
        },
        {
            "last_affected":  "7.5.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
CVE-2018-1064
CVE-2019-10132
CVE-2019-10161
CVE-2019-10166
CVE-2019-10167
CVE-2019-10168
CVE-2019-3886
CVE-2020-14339
CVE-2020-25637
CVE-2021-3631
v4.*
v4.1.0
v4.10.0
v4.10.0-rc1
v4.10.0-rc2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.5.0
v4.5.0-rc1
v4.5.0-rc2
v4.6.0
v4.6.0-rc1
v4.6.0-rc2
v4.7.0
v4.7.0-rc1
v4.7.0-rc2
v4.8.0
v4.8.0-rc1
v4.8.0-rc2
v4.9.0
v4.9.0-rc1
v5.*
v5.0.0
v5.0.0-rc1
v5.0.0-rc2
v5.1.0
v5.1.0-rc1
v5.1.0-rc2
v5.10.0
v5.10.0-rc1
v5.10.0-rc2
v5.2.0
v5.2.0-rc1
v5.2.0-rc2
v5.3.0
v5.3.0-rc1
v5.3.0-rc2
v5.4.0
v5.4.0-rc1
v5.4.0-rc2
v5.5.0
v5.5.0-rc1
v5.5.0-rc2
v5.6.0
v5.6.0-rc1
v5.6.0-rc2
v5.7.0
v5.7.0-rc1
v5.7.0-rc2
v5.8.0
v5.8.0-rc1
v5.8.0-rc2
v5.9.0
v5.9.0-rc1
v6.*
v6.0.0
v6.0.0-rc1
v6.0.0-rc2
v6.1.0
v6.1.0-rc1
v6.1.0-rc2
v6.10.0
v6.10.0-rc1
v6.10.0-rc2
v6.2.0
v6.2.0-rc1
v6.3.0
v6.3.0-rc1
v6.4.0
v6.4.0-rc1
v6.5.0
v6.5.0-rc1
v6.5.0-rc2
v6.6.0
v6.6.0-rc1
v6.7.0
v6.7.0-rc1
v6.7.0-rc2
v6.8.0
v6.8.0-rc1
v6.8.0-rc2
v6.9.0
v6.9.0-rc1
v6.9.0-rc2
v7.*
v7.0.0
v7.0.0-rc1
v7.0.0-rc2
v7.1.0
v7.1.0-rc1
v7.1.0-rc2
v7.2.0
v7.2.0-rc1
v7.2.0-rc2
v7.3.0
v7.3.0-rc1
v7.3.0-rc2
v7.4.0
v7.4.0-rc1
v7.4.0-rc2
v7.5.0
v7.5.0-rc1
v7.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3667.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "63369119804262480602584117246342452608",
            "length":  747
        },
        "id":  "CVE-2021-3667-57b6bb4d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/libvirt/libvirt@447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87",
        "target":  {
            "file":  "src/storage/storage_driver.c",
            "function":  "storagePoolLookupByTargetPath"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "195877491387619479579158237720163764491",
                "90682379184772759765846818989144802475",
                "317837978998188109099395814412819850670",
                "336804048009231029245701955274722411095",
                "94913288173034920064177808702328388873"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-3667-cd1a45ce",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/libvirt/libvirt@447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87",
        "target":  {
            "file":  "src/storage/storage_driver.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-09T05:44:43Z"