CVE-2021-4147 Denial of service in libvirt
A malicious guest can cause the libvirtd host daemon to deadlock or crash by continuously rebooting, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4147?
CVE-2021-4147 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 25 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition.
Weakness: CWE-667
Which versions are affected by CVE-2021-4147?
It affects 3 products.
Linux distribution packages (5)
libvirt SUSE:Linux Enterprise Micro 5.1 | All versions | 7.1.0-6.11.1 |
libvirt SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 7.1.0-6.11.1 |
libvirt SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 7.1.0-6.11.1 |
libvirt openSUSE:Leap 15.3 | All versions | 7.1.0-6.11.1 |
libvirt openSUSE:Tumbleweed | All versions | 8.0.0-1.1 |
Products include Fedoraproject Fedora, Netapp Ontap Select Deploy Administration Utility, Redhat Libvirt.
How do I fix CVE-2021-4147?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-4147 being exploited?
There is no known exploitation of CVE-2021-4147 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2021-4147, GHSA-hh52-g3xv-6xxc, SUSE-SU-2022:0021-1, UBUNTU-CVE-2021-4147, openSUSE-SU-2022:0021-1, openSUSE-SU-2024:11758-1.