---
id: CVE-2023-3750
title: >-
  Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of
  service
summary: >-
  A flaw was found in libvirt. The virStoragePoolObjListSearch function does not
  return a locked pool as expected, resulting in a race condition and denial of
  service when attempting to lock the same object from another thread. This
  issue …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-667
vendor: Red Hat
product: libvirt
affected:
  - libvirt (all versions)
  - libvirt
  - libvirt
  - 'virt:rhel/libvirt'
  - 'virt:av/libvirt'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-02-12T17:10:30.759511Z'
published: '2023-07-24'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T11:32:02.861Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-3750'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:6409'
    label: 'RHSA-2023:6409'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-3750'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2222210'
    label: RHBZ#2222210
tags:
  - cve.org
epss: 0.0076
epssPercentile: 0.55517
ingestedAt: '2026-11-07T12:16:41.114Z'
---

## Overview

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon.

## Affected

- `libvirt (all versions)`
- `libvirt`
- `libvirt`
- `virt:rhel/libvirt`
- `virt:av/libvirt`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.