CVE-2021-3631 : A flaw was found in libvirt while it generates SELinux MCS category pairs for VM

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

Published 2022-03-02 23:15:09

Updated 2024-04-01 13:16:41

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-3631

Redhat » Enterprise Linux » Version: 8.0 Advanced Virtualization Edition
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
Matching versions
Redhat » Libvirt
Versions before (<) 7.5.0
cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 4.8
cpe:2.3:a:redhat:openshift_container_platform:4.8:*:*:*:*:*:*:*
Matching versions
Netapp » Ontap Select Deploy Administration Utility » Version: N/A
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2021-3631

Top countries where our scanners detected CVE-2021-3631

Top open port discovered on systems with this issue 53

IPs affected by CVE-2021-3631 61,437

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-3631!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-3631

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-3631

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:L/AC:M/Au:N/C:P/I:P/A:N	3.4	4.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.3	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N	1.0	5.2	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-3631

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Assigned by:
- nvd@nist.gov (Secondary)
- secalert@redhat.com (Primary)

References for CVE-2021-3631

https://security.gentoo.org/glsa/202210-06

libvirt: Multiple Vulnerabilities (GLSA 202210-06) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20220331-0010/

CVE-2021-3631 Libvirt Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://gitlab.com/libvirt/libvirt/-/issues/153

Selinux MCS generate a single category context and may be accessed by another machine (#153) · Issues · libvirt / libvirt · GitLab
Exploit;Third Party Advisory
https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2

security: fix SELinux label generation logic (15073504) · Commits · libvirt / libvirt · GitLab
Patch;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1977726

1977726 – (CVE-2021-3631) CVE-2021-3631 libvirt: Insecure sVirt label generation
Issue Tracking;Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html

[SECURITY] [DLA 3778-1] libvirt security update

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2021:3631

RHSA-2021:3631 - Security Advisory - Red Hat Customer Portal
Vendor Advisory