CVE-2022-0897

Description

A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

CVSS Metrics

• v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.08%• Percentile: 23%

Techniques & Countermeasures

• CWE-667•Improper Locking

  The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Systems

• netapp•ontap_select_deploy_administration_utility

  na

• redhat•libvirt

  ≤ 1.1.1

References (3)

• https://bugzilla.redhat.com/show_bug.cgi?id=2063883
• https://security.gentoo.org/glsa/202210-06
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html