CVE-2021-3631

NameCVE-2021-3631
DescriptionA flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3778-1
Debian Bugs990709

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libvirt (PTS)buster5.0.0-4+deb10u1vulnerable
buster (security)5.0.0-4+deb10u2fixed
bullseye7.0.0-3+deb11u2vulnerable
bookworm9.0.0-4fixed
sid, trixie10.3.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libvirtsourcebuster5.0.0-4+deb10u2DLA-3778-1
libvirtsource(unstable)7.6.0-1990709

Notes

[bullseye] - libvirt <no-dsa> (Minor issue)
[stretch] - libvirt <no-dsa> (Minor issue)
https://gitlab.com/libvirt/libvirt/-/issues/153
Fixed by: https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2 (v7.5.0)

Search for package or bug name: Reporting problems