Low: virt:rhel and virt-devel:rhel security update
Summary
ALSA-2021:5238: Low: virt:rhel and virt-devel:rhel security update. Affects hivex versions < 1.3.18-21.module_el8.5.0+2608+72063365. Fixed in 1.3.18-21.module_el8.5.0+2608+72063365. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.
Vulnerability Detail
The vulnerability (CVE-2021-3930) is an off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c in QEMU. It can be exploited by an attacker to cause a denial of service (DoS) or potentially execute arbitrary code. Another vulnerability (CVE-2021-20257) in QEMU's e1000 network driver can lead to an infinite loop while processing transmit descriptors.
How To Fix
Minimum fixed version
1.3.18-21.module_el8.5.0+2608+72063365
This is the first release that contains the fix.
sudo dnf update hivexTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update the affected packages to the fixed versions to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for hivex →
FAQ
The impact of these vulnerabilities can range from a denial of service (DoS) to potential arbitrary code execution, depending on the attacker's capabilities and the specific circumstances of the system.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is always recommended to apply security updates as soon as possible to mitigate any potential risks.
The fixed versions for the affected packages can be found in the 'fixed' field of each package entry in the 'affected' section of this advisory.
No specific workaround is mentioned for these vulnerabilities. It is recommended to update the affected packages to the fixed versions.
More information about these vulnerabilities, including their impact, CVSS score, acknowledgments, and related details, can be found on the respective CVE pages listed in the References section of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for hivex.
