Libvirt Security Notice: LSN-2021-0002
        ======================================

       Summary: improper locking on ACL failure in
                virStoragePoolLookupByTargetPath API
   Reported on: 20210721
  Published on: 20210721
      Fixed on: 20210723
   Reported by: Yan Fu <yafu@redhat.com>
    Patched by: Peter Krempa <pkrempa@redhat.com>
      See also: CVE-2021-3667, redhat bug #1984318

Description
-----------

The error path on ACL failure did not release the lock on the
storage pool object.

Impact
------

When using ACLs, a user with no permission to access the pool could
deny others from accessing the storage pool object.

Workaround
----------

Deny the user access to the virStoragePoolLookupByTargetPath API.

Affected product
----------------

        Name: libvirt
  Repository: https://gitlab.com/libvirt/libvirt

      Branch: master
   Broken in: v4.1.0
   Broken in: v4.2.0
   Broken in: v4.3.0
   Broken in: v4.4.0
   Broken in: v4.5.0
   Broken in: v4.6.0
   Broken in: v4.7.0
   Broken in: v4.8.0
   Broken in: v4.9.0
   Broken in: v4.10.0
   Broken in: v5.0.0
   Broken in: v5.1.0
   Broken in: v5.2.0
   Broken in: v5.3.0
   Broken in: v5.4.0
   Broken in: v5.5.0
   Broken in: v5.6.0
   Broken in: v5.7.0
   Broken in: v5.8.0
   Broken in: v5.9.0
   Broken in: v5.10.0
   Broken in: v6.0.0
   Broken in: v6.1.0
   Broken in: v6.2.0
   Broken in: v6.3.0
   Broken in: v6.4.0
   Broken in: v6.5.0
   Broken in: v6.6.0
   Broken in: v6.7.0
   Broken in: v6.8.0
   Broken in: v6.9.0
   Broken in: v6.10.0
   Broken in: v7.0.0
   Broken in: v7.1.0
   Broken in: v7.2.0
   Broken in: v7.3.0
   Broken in: v7.4.0
   Broken in: v7.5.0
    Fixed in: v7.6.0
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129
    Fixed by: 447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87

      Branch: v4.1-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.2-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.3-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.4-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.5-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.6-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.7-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.8-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.9-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v4.10-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v5.0-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v5.1-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v5.1.0-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v5.2-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129

      Branch: v5.3-maint
   Broken by: 7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129