Bugzilla – Bug 1192876
VUL-0: CVE-2021-3975: libvirt: segmentation fault during VM shutdown can lead to vdsm hung
Last modified: 2022-12-02 10:45:32 UTC
rh#2024326 A use-after-free flaw was found in qemuProcessHandleMonitorEOF() within src/qemu/qemu_process.c which makes a call to qemuMonitorUnregister() via multiple threads without being protected by a monitor lock. This issue could be used by a unprivileged user to perform a denial of service attack by causing segmentation fault on libvirt. Fixed upstream in libvirt: https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7 References: https://bugzilla.redhat.com/show_bug.cgi?id=2024326 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3975
Affected codestreams: - SUSE:SLE-12-SP2:Update - SUSE:SLE-12-SP3:Update - SUSE:SLE-12-SP4:Update - SUSE:SLE-12-SP5:Update - SUSE:SLE-15:Update - SUSE:SLE-15-SP1:Update - SUSE:SLE-15-SP2:Update
Notes to self: git describe --contains 1ac703a7d0 v7.1.0-rc2~5 Backports done for all code stream mentioned in #1. An updated libvirt package can be submitted at any time. For 12SP5 and >=15SP2, I should wait until fixes are ready for bug#1191668 et.al.
Hi James, I only see the submission for SLE-12-SP5 / libvirt, can you please submit for the remaining affected codestreams?
(In reply to Gianluca Gabrielli from comment #4) > Hi James, I only see the submission for SLE-12-SP5 / libvirt, can you please > submit for the remaining affected codestreams? Submissions are done for the entire lot now :-). Reassigning to the security team.
SUSE-SU-2022:0031-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): libvirt-4.0.0-9.40.1 SUSE Linux Enterprise Server 15-LTSS (src): libvirt-4.0.0-9.40.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): libvirt-4.0.0-9.40.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): libvirt-4.0.0-9.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0032-1: An update that solves two vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1190420,1191668,1192017,1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): libvirt-5.1.0-13.28.2 SUSE Linux Enterprise Server 12-SP5 (src): libvirt-5.1.0-13.28.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0042-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): libvirt-4.0.0-8.26.1 SUSE OpenStack Cloud 9 (src): libvirt-4.0.0-8.26.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): libvirt-4.0.0-8.26.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): libvirt-4.0.0-8.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0041-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): libvirt-3.3.0-5.49.1 SUSE OpenStack Cloud 8 (src): libvirt-3.3.0-5.49.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): libvirt-3.3.0-5.49.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): libvirt-3.3.0-5.49.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): libvirt-3.3.0-5.49.1 HPE Helion Openstack 8 (src): libvirt-3.3.0-5.49.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0045-1: An update that solves two vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1183411,1191668,1192017,1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE MicroOS 5.0 (src): libvirt-6.0.0-13.24.1 SUSE Manager Server 4.1 (src): libvirt-6.0.0-13.24.1 SUSE Manager Retail Branch Server 4.1 (src): libvirt-6.0.0-13.24.1 SUSE Manager Proxy 4.1 (src): libvirt-6.0.0-13.24.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): libvirt-6.0.0-13.24.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): libvirt-6.0.0-13.24.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): libvirt-6.0.0-13.24.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): libvirt-6.0.0-13.24.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): libvirt-6.0.0-13.24.1 SUSE Enterprise Storage 7 (src): libvirt-6.0.0-13.24.1 SUSE CaaS Platform 4.5 (src): libvirt-6.0.0-13.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0128-1: An update that solves two vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1191668,1192017,1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): libvirt-5.1.0-17.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): libvirt-5.1.0-17.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): libvirt-5.1.0-17.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): libvirt-5.1.0-17.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): libvirt-5.1.0-17.1 SUSE Enterprise Storage 6 (src): libvirt-5.1.0-17.1 SUSE CaaS Platform 4.0 (src): libvirt-5.1.0-17.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0045-2: An update that solves two vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1183411,1191668,1192017,1192876,1193981,1194041 CVE References: CVE-2021-3975,CVE-2021-4147 JIRA References: Sources used: SUSE Linux Enterprise Realtime Extension 15-SP2 (src): libvirt-6.0.0-13.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.