libvirt: deadlock and crash in libxl driver
Published Mar 25, 2022
6.5
MEDIUMCVSS 3.1
EPSS 0.24%
Description
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition.
Affected products
- Vendor n/a Product Libvirt Defaultunknown
Affected
- libvirt 2.33.0
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| n/a | Libvirt | unknown | Affected
|
Configuration 2
- 35
Configuration 3
- n/a
No data.
Red Hat Enterprise Linux 6
libvirt
Not affected
Red Hat Enterprise Linux 7
libvirt
Not affected
Red Hat Enterprise Linux 8
virt:rhel/libvirt
Not affected
Red Hat Enterprise Linux 8 Advanced Virtualization
virt:8.2/libvirt
Not affected
Red Hat Enterprise Linux 8 Advanced Virtualization
virt:av/libvirt
Not affected
Red Hat Enterprise Linux 9
libvirt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | libvirt | Not affected | n/a |
| Red Hat Enterprise Linux 7 | libvirt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | virt:rhel/libvirt | Not affected | n/a |
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:8.2/libvirt | Not affected | n/a |
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:av/libvirt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | libvirt | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
The versions of `libvirt` as shipped with Red Hat Enterprise Linux do not support the libxl hypervisor driver for Xen. Therefore, Red Hat Enterprise Linux is not affected by this flaw.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (7)
- https://access.redhat.com/security/cve/CVE-2021-4147 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2034195 Issue TrackingPatchVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34015 Advisory
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2021-4147
- https://security.netapp.com/advisory/ntap-20220513-0004/ Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-4147
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-4147 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2034195 | Issue TrackingPatchVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34015 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | mailing-list | |
| https://nvd.nist.gov/vuln/detail/CVE-2021-4147 | ||
| https://security.netapp.com/advisory/ntap-20220513-0004/ | Third Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2021-4147 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data