### [CVE-2021-3667](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3667)
![](https://img.shields.io/static/v1?label=Product&message=libvirt&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Fixedin%20-%20libvert%20v7.6.0-rc1%20and%20above%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-667%20%20(improper%20Locking)&color=brightgreen)

### Description

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon