Medium severity · published Mar 2, 2022
CVE-2021-3631
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
8.0 · source: NVD
LI
Libvirt · Redhat
before 7.5.0 · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
OC
Openshift Container Platform · Redhat
4.8 · source: NVD
Affected product
OS
Ontap Select Deploy Administration Utility
Netapp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3631
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3631
Vendor Advisory
https://access.redhat.com/errata/RHSA-2021:3631
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1977726
Patch
https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2
Exploit
https://gitlab.com/libvirt/libvirt/-/issues/153
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
Third Party Advisory
https://security.gentoo.org/glsa/202210-06
More from Ontap Select Deploy Administration Utility
9.6
CVE-2020-15999
Google Chrome FreeType Heap Buffer Overflow Vulnerability
7.8
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
7.0
CVE-2016-5195
Linux Kernel Race Condition Vulnerability
9.8
CVE-2024-21990
ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration…