CVE-2022-0897

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-0897
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2063883 Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
https://security.gentoo.org/glsa/202210-06 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
History

01 Apr 2024, 13:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html -

27 Oct 2022, 20:54

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202210-06 - (GENTOO) https://security.gentoo.org/glsa/202210-06 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2063883 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2063883 - Issue Tracking

16 Oct 2022, 17:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202210-06 -

09 Sep 2022, 15:15

Type Values Removed Values Added
References
  • {'url': 'https://gitlab.com/libvirt/libvirt/-/commit/a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36', 'name': 'https://gitlab.com/libvirt/libvirt/-/commit/a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20220519-0002/', 'name': 'https://security.netapp.com/advisory/ntap-20220519-0002/', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2063883 -
Summary A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the `driver->nwfilters` mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the `driver->nwfilters` object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt’s API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd). A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

21 Jul 2022, 12:12

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220519-0002/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220519-0002/ - Third Party Advisory
CPE cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

19 May 2022, 20:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220519-0002/ -

07 Apr 2022, 16:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.0
v3 : 4.3
References (MISC) https://gitlab.com/libvirt/libvirt/-/commit/a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36 - (MISC) https://gitlab.com/libvirt/libvirt/-/commit/a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36 - Patch, Third Party Advisory
CPE cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*
CWE CWE-667

25 Mar 2022, 19:44

Type Values Removed Values Added
New CVE
Information

Published : 2022-03-25 19:15

Updated : 2024-04-01 13:16

NVD link : CVE-2022-0897

Mitre link : CVE-2022-0897

CVE.ORG link : CVE-2022-0897

JSON object : View

Products Affected

redhat

  • libvirt

netapp

  • ontap_select_deploy_administration_utility
CWE
CWE-667

Improper Locking