Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
Summary
ALSA-2020:4676: Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update. Affects hivex versions < 1.3.18-20.module_el8.3.0+2048+e7a0a3ea. Fixed in 1.3.18-20.module_el8.3.0+2048+e7a0a3ea. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.
Vulnerability Detail
This update addresses several security vulnerabilities in the virt:rhel and virt-devel:rhel packages. These vulnerabilities include a leak of /dev/mapper/control into QEMU guests, a use-after-free vulnerability in the Slirp component, a potential denial of service vulnerability via an active pool without a target path, and a leak of sensitive cookie information via dumpxml. These vulnerabilities could potentially lead to information disclosure, denial of service, or other security issues.
How To Fix
Minimum fixed version
1.3.18-20.module_el8.3.0+2048+e7a0a3ea
This is the first release that contains the fix.
sudo dnf update hivexTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this update addresses several security vulnerabilities in the virt:rhel and virt-devel:rhel packages. It is recommended to update the affected packages to the latest version to mitigate these vulnerabilities. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hivex →
FAQ
These vulnerabilities could potentially lead to information disclosure, denial of service, or other security issues.
To fix these vulnerabilities, it is recommended to update the affected packages to the latest version.
No specific workarounds have been mentioned for these vulnerabilities.
For more details about these vulnerabilities, including the impact, CVSS score, and other related information, refer to the CVE pages listed in the References section.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for hivex.
