Moderate: virt:rhel and virt-devel:rhel security update
Summary
ALSA-2021:1064: Moderate: virt:rhel and virt-devel:rhel security update. Affects hivex versions < 1.3.18-20.module_el8.3.0+2048+e7a0a3ea. Fixed in 1.3.18-20.module_el8.3.0+2048+e7a0a3ea. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The virt:rhel module provides user-space components used to run virtual machines using Kernel-based Virtual Machine (KVM). It also offers APIs for managing and interacting with the virtualized systems. The module is designed to provide a full virtualization solution for Linux on various hardware platforms.
Vulnerability Detail
The vulnerability (CVE-2021-20295) is a regression of the CVE-2020-10756 fix in virt:rhel/qemu-kvm in AlmaLinux. It affects the virt:rhel and virt-devel:rhel packages. The specific details of the vulnerability, including its impact and CVSS score, can be found on the CVE page.
How To Fix
Minimum fixed version
1.3.18-20.module_el8.3.0+2048+e7a0a3ea
This is the first release that contains the fix.
sudo dnf update hivexTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the virt:rhel and virt-devel:rhel packages in AlmaLinux are affected by a moderate security vulnerability. It is recommended to update the affected packages to the fixed versions to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for hivex →
FAQ
The virt:rhel module provides user-space components used to run virtual machines using KVM. It also offers APIs for managing and interacting with the virtualized systems.
The impact of the vulnerability is not specified in the provided details. Please refer to the CVE page for more information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
No specific workarounds are mentioned in the provided details. It is recommended to update the affected packages to the fixed versions.
You can find more information about the vulnerability, including its impact, CVSS score, and acknowledgments, on the CVE page listed in the provided vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for hivex.
