Important: Kernel Security and Bug Fix Update for kernel-tools-libs-devel
Summary
ALSA-2021:2168: Important: kernel security and bug fix update. Affects kernel-tools-libs-devel versions < 4.18.0-305.3.1.el8_4. Fixed in 4.18.0-305.3.1.el8_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel packages contain the Linux kernel, which serves as the core of any Linux operating system. It provides essential functionality and interfaces for various hardware and software components. The kernel-tools-libs-devel package is specifically designed for developers and includes libraries and tools for kernel development and debugging.
Vulnerability Detail
This update addresses multiple security vulnerabilities and bug fixes in the kernel-tools-libs-devel package. The vulnerabilities include:
-
CVE-2021-3501: Userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu->run. This could lead to privilege escalation or denial of service.
-
CVE-2021-3543: Nitro_enclaves may have stale file descriptors on failed usercopy, which could be exploited by an attacker to gain unauthorized access or execute arbitrary code.
These vulnerabilities pose a significant risk to the security and stability of systems running the affected package.
How To Fix
Minimum fixed version
4.18.0-305.3.1.el8_4
This is the first release that contains the fix.
sudo dnf update kernel-tools-libs-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the kernel-tools-libs-devel package is affected by multiple security vulnerabilities that could lead to privilege escalation, denial of service, or unauthorized access. It is crucial to update the package to the latest version to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kernel-tools-libs-devel →
FAQ
CVE-2021-3501 allows userspace applications to write 16 bytes at an offset up to 32 GB from vcpu->run. This could potentially lead to privilege escalation or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file, and Vulert will analyze it in real-time.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the affected package to the latest version.
There is no evidence of active exploits targeting these vulnerabilities at the moment. However, it is crucial to apply the security update as soon as possible to mitigate the risk.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related details, on the respective CVE pages: CVE-2021-3501 and CVE-2021-3543.
References
Related vulnerabilities
Recent vulnerabilities recorded for kernel-tools-libs-devel.
