CVE-2021-3667

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3667
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3667.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3667
Downstream
ALSA (1)
CLSA (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (3)
RHSA (3)
RLSA (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (1)
openSUSE (3)
SUSE (4)
Published
2022-03-02T23:15:08Z
Modified
2026-10-24T14:12:12Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.0"
                        },
                        {
                            "last_affected": "8.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "redhat:enterprise_linux"
        }
    ]
}
References

Affected packages

Git / github.com/libvirt/libvirt

Affected ranges

Type
GIT
Repo
https://github.com/libvirt/libvirt
Events
Introduced
6b59754bfda9477586a75af0c0b9ce1036c414e8
Last Affected
03eadc86fc5cdadbc4ab18123d820b6e4e321abd
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "7.5.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

Other
CVE-2018-1064
CVE-2018-3639
CVE-2019-10132
CVE-2019-10161
CVE-2019-10166
CVE-2019-10167
CVE-2019-10168
CVE-2019-11135
CVE-2019-20485
CVE-2019-3840
CVE-2019-3886
CVE-2020-10703
CVE-2020-14301
CVE-2020-14339
CVE-2020-25637
CVE-2021-3631
v4.*
v4.1.0
v4.10.0
v4.10.0-rc1
v4.10.0-rc2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.5.0
v4.5.0-rc1
v4.5.0-rc2
v4.6.0
v4.6.0-rc1
v4.6.0-rc2
v4.7.0
v4.7.0-rc1
v4.7.0-rc2
v4.8.0
v4.8.0-rc1
v4.8.0-rc2
v4.9.0
v4.9.0-rc1
v5.*
v5.0.0
v5.0.0-rc1
v5.0.0-rc2
v5.1.0
v5.1.0-rc1
v5.1.0-rc2
v5.10.0
v5.10.0-rc1
v5.10.0-rc2
v5.2.0
v5.2.0-rc1
v5.2.0-rc2
v5.3.0
v5.3.0-rc1
v5.3.0-rc2
v5.4.0
v5.4.0-rc1
v5.4.0-rc2
v5.5.0
v5.5.0-rc1
v5.5.0-rc2
v5.6.0
v5.6.0-rc1
v5.6.0-rc2
v5.7.0
v5.7.0-rc1
v5.7.0-rc2
v5.8.0
v5.8.0-rc1
v5.8.0-rc2
v5.9.0
v5.9.0-rc1
v6.*
v6.0.0
v6.0.0-rc1
v6.0.0-rc2
v6.1.0
v6.1.0-rc1
v6.1.0-rc2
v6.10.0
v6.10.0-rc1
v6.10.0-rc2
v6.2.0
v6.2.0-rc1
v6.3.0
v6.3.0-rc1
v6.4.0
v6.4.0-rc1
v6.5.0
v6.5.0-rc1
v6.5.0-rc2
v6.6.0
v6.6.0-rc1
v6.7.0
v6.7.0-rc1
v6.7.0-rc2
v6.8.0
v6.8.0-rc1
v6.8.0-rc2
v6.9.0
v6.9.0-rc1
v6.9.0-rc2
v7.*
v7.0.0
v7.0.0-rc1
v7.0.0-rc2
v7.1.0
v7.1.0-rc1
v7.1.0-rc2
v7.2.0
v7.2.0-rc1
v7.2.0-rc2
v7.3.0
v7.3.0-rc1
v7.3.0-rc2
v7.4.0
v7.4.0-rc1
v7.4.0-rc2
v7.5.0
v7.5.0-rc1
v7.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3667.json"

Git / gitlab.com/libvirt/libvirt

Affected ranges

Type
GIT
Repo
https://gitlab.com/libvirt/libvirt
Events
Introduced
6b59754bfda9477586a75af0c0b9ce1036c414e8
Last Affected
03eadc86fc5cdadbc4ab18123d820b6e4e321abd
Fixed
447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "7.5.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
CVE-2018-1064
CVE-2018-3639
CVE-2019-10132
CVE-2019-10161
CVE-2019-10166
CVE-2019-10167
CVE-2019-10168
CVE-2019-11135
CVE-2019-20485
CVE-2019-3840
CVE-2019-3886
CVE-2020-10703
CVE-2020-14301
CVE-2020-14339
CVE-2020-25637
CVE-2021-3631
v4.*
v4.1.0
v4.10.0
v4.10.0-rc1
v4.10.0-rc2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.5.0
v4.5.0-rc1
v4.5.0-rc2
v4.6.0
v4.6.0-rc1
v4.6.0-rc2
v4.7.0
v4.7.0-rc1
v4.7.0-rc2
v4.8.0
v4.8.0-rc1
v4.8.0-rc2
v4.9.0
v4.9.0-rc1
v5.*
v5.0.0
v5.0.0-rc1
v5.0.0-rc2
v5.1.0
v5.1.0-rc1
v5.1.0-rc2
v5.10.0
v5.10.0-rc1
v5.10.0-rc2
v5.2.0
v5.2.0-rc1
v5.2.0-rc2
v5.3.0
v5.3.0-rc1
v5.3.0-rc2
v5.4.0
v5.4.0-rc1
v5.4.0-rc2
v5.5.0
v5.5.0-rc1
v5.5.0-rc2
v5.6.0
v5.6.0-rc1
v5.6.0-rc2
v5.7.0
v5.7.0-rc1
v5.7.0-rc2
v5.8.0
v5.8.0-rc1
v5.8.0-rc2
v5.9.0
v5.9.0-rc1
v6.*
v6.0.0
v6.0.0-rc1
v6.0.0-rc2
v6.1.0
v6.1.0-rc1
v6.1.0-rc2
v6.10.0
v6.10.0-rc1
v6.10.0-rc2
v6.2.0
v6.2.0-rc1
v6.3.0
v6.3.0-rc1
v6.4.0
v6.4.0-rc1
v6.5.0
v6.5.0-rc1
v6.5.0-rc2
v6.6.0
v6.6.0-rc1
v6.7.0
v6.7.0-rc1
v6.7.0-rc2
v6.8.0
v6.8.0-rc1
v6.8.0-rc2
v6.9.0
v6.9.0-rc1
v6.9.0-rc2
v7.*
v7.0.0
v7.0.0-rc1
v7.0.0-rc2
v7.1.0
v7.1.0-rc1
v7.1.0-rc2
v7.2.0
v7.2.0-rc1
v7.2.0-rc2
v7.3.0
v7.3.0-rc1
v7.3.0-rc2
v7.4.0
v7.4.0-rc1
v7.4.0-rc2
v7.5.0
v7.5.0-rc1
v7.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3667.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "63369119804262480602584117246342452608",
            "length": 747
        },
        "id": "CVE-2021-3667-57b6bb4d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.com/libvirt/libvirt@447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87",
        "target": {
            "file": "src/storage/storage_driver.c",
            "function": "storagePoolLookupByTargetPath"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195877491387619479579158237720163764491",
                "90682379184772759765846818989144802475",
                "317837978998188109099395814412819850670",
                "336804048009231029245701955274722411095",
                "94913288173034920064177808702328388873"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-3667-cd1a45ce",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitlab.com/libvirt/libvirt@447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87",
        "target": {
            "file": "src/storage/storage_driver.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T14:12:12Z"