CVE-2021-3975
Estado: ModificadaMedia (6.5)—
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.54%
- Percentil entre todas las CVEs puntuadas: 74
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (14)
Canonical — Ubuntu LinuxDebian — Debian LinuxFedoraproject — FedoraNetapp — Ontap Select Deploy Administration UtilityRedhat — Codeready Linux BuilderRedhat — Enterprise LinuxRedhat — Enterprise Linux EUSRedhat — Enterprise Linux FOR IBM Z SystemsRedhat — Enterprise Linux FOR IBM Z Systems EUSRedhat — Enterprise Linux FOR Power Little EndianRedhat — Enterprise Linux FOR Power Little Endian EUSRedhat — Enterprise Linux Server FOR Power Little Endian Update Services FOR SAP SolutionsRedhat — Enterprise Linux Server TUSRedhat — Libvirt
CWE
- CWE-416
- CWE-416
Referencias
- https://access.redhat.com/security/cve/CVE-2021-3975
- https://bugzilla.redhat.com/show_bug.cgi?id=2024326
- https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://security.netapp.com/advisory/ntap-20221201-0002/
- https://ubuntu.com/security/CVE-2021-3975
- https://access.redhat.com/security/cve/CVE-2021-3975
- https://bugzilla.redhat.com/show_bug.cgi?id=2024326
- https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://security.netapp.com/advisory/ntap-20221201-0002/
- https://ubuntu.com/security/CVE-2021-3975
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-3975",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "libvirt",
"versions": [
{
"status": "affected",
"version": "Fixed in libvirt v7.1.0"
}
]
}
]
}
],
"published": "2022-08-23T20:15:08.427",
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2021-3975",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024326",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html",
"source": "secalert@redhat.com"
},
{
"url": "https://security.netapp.com/advisory/ntap-20221201-0002/",
"tags": [
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://ubuntu.com/security/CVE-2021-3975",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-3975",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024326",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20221201-0002/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://ubuntu.com/security/CVE-2021-3975",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
},
{
"type": "Secondary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash."
},
{
"lang": "es",
"value": "Se ha encontrado un fallo de uso de memoria previamente liberada en libvirt. La función qemuMonitorUnregister() en qemuProcessHandleMonitorEOF es llamada usando múltiples hilos sin estar adecuadamente protegida por un bloqueo de monitor. Este fallo podría ser activado por la API virConnectGetAllDomainStats cuando el huésped está siendo apagado. Un cliente no privilegiado con una conexión de sólo lectura podría usar este fallo para llevar a cabo un ataque de denegación de servicio causando el bloqueo del demonio libvirt."
}
],
"lastModified": "2026-06-17T04:06:19.470",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "248F6876-51F6-4A2B-999C-FDEE82D40689",
"versionEndExcluding": "7.1.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAE4D2D0-CEEB-416F-8BC5-A7987DF56190"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C3741B8-851F-475D-B428-523F4F722350"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87C21FE1-EA5C-498F-9C6C-D05F91A88217"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EF5C4AC-CA69-41E3-AD93-7AC21931374A"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47811209-5CE5-4375-8391-B0A7F6A0E420"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "729C515E-1DD3-466D-A50B-AFE058FFC94A"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "871A5C26-DB7B-4870-A5B2-5DD24C90B4A7"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1272DF03-7674-4BD4-8E64-94004B195448"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CD81C46-328B-412D-AF4E-68A2AD2F1A73"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6C3741B8-851F-475D-B428-523F4F722350"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "87C21FE1-EA5C-498F-9C6C-D05F91A88217"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9EF5C4AC-CA69-41E3-AD93-7AC21931374A"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "47811209-5CE5-4375-8391-B0A7F6A0E420"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "729C515E-1DD3-466D-A50B-AFE058FFC94A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7CF3019-975D-40BB-A8A4-894E62BD3797"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}