CVE-2021-3667

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

• CWE-667
• CWE-667

• https://bugzilla.redhat.com/show_bug.cgi?id=1986094Issue Tracking, Vendor Advisory
• https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87Patch, Third Party Advisory
• https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87Patch
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-06Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220331-0005/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1986094Issue Tracking, Vendor Advisory
• https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87Patch, Third Party Advisory
• https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87Patch
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-06Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220331-0005/Third Party Advisory

Published

Mar 2, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36654CMSuno 1.7 is vulnerable to an authenticated stored cross si…5.4
• CVE-2021-3666body-parser-xml is vulnerable to Improperly Controlled Modif…9.8
• CVE-2021-36665An issue was discovered in Druva 6.9.0 for macOS, allows att…7.8
• CVE-2021-36666An issue was discovered in Druva 6.9.0 for MacOS, allows att…7.8
• CVE-2021-36667Command injection vulnerability in Druva inSync 6.9.0 for Ma…7.8
• CVE-2021-36668URL injection in Driva inSync 6.9.0 for MacOS, allows attack…7.8
• CVE-2021-36686Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allow…5.4
• CVE-2021-36689An issue discovered in com.samourai.wallet.PinEntryActivity.…5.5
• CVE-2021-3669A flaw was found in the Linux kernel. Measuring usage of the…5.5
• CVE-2021-36690A segmentation fault can occur in the sqlite3.exe command-li…7.5
• CVE-2021-36691libjxl v0.5.0 is affected by a Assertion failed issue in lib…7.5
• CVE-2021-36692libjxl v0.3.7 is affected by a Divide By Zero in issue in li…6.5