Important: Kernel Security and Bug Fix Update - kernel-tools-libs-devel
Summary
ALSA-2021:2570: Important: kernel security and bug fix update. Affects kernel-tools-libs-devel versions < 4.18.0-305.7.1.el8_4. Fixed in 4.18.0-305.7.1.el8_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-tools-libs-devel package is a part of the AlmaLinux 8 operating system. It provides libraries and development files for kernel tools. These tools are essential for managing and monitoring the Linux kernel, which is the core of the operating system. The package enables developers to build and debug kernel-related applications. However, a vulnerability has been discovered in this package that could potentially lead to security breaches and other issues.
Vulnerability Detail
The vulnerability identified in the kernel-tools-libs-devel package is a use-after-free vulnerability in the net/bluetooth/hci_event.c file. When destroying an hci_chan, a use-after-free condition occurs, allowing an attacker to potentially execute arbitrary code or cause a denial-of-service attack. This vulnerability is tracked as CVE-2021-33034. Another security bypass vulnerability has also been found in the certs/blacklist.c and certs/system_keyring.c files, which could allow an attacker to bypass security measures. This vulnerability is tracked as CVE-2020-26541. These vulnerabilities pose a significant risk to the integrity and security of the AlmaLinux 8 operating system.
How To Fix
Minimum fixed version
4.18.0-305.7.1.el8_4
This is the first release that contains the fix.
sudo dnf update kernel-tools-libs-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The kernel-tools-libs-devel package in AlmaLinux 8 is affected by two vulnerabilities: a use-after-free vulnerability and a security bypass vulnerability. These vulnerabilities can lead to arbitrary code execution, denial-of-service attacks, and security bypass. To mitigate these risks, it is crucial to update the package to version 4.18.0-305.7.1.el8_4 or later. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for kernel-tools-libs-devel →
FAQ
These vulnerabilities can potentially allow an attacker to execute arbitrary code, cause a denial-of-service attack, or bypass security measures. They pose a significant risk to the security and integrity of the AlmaLinux 8 operating system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to apply the official update provided by AlmaLinux to fix the vulnerabilities.
Yes, these vulnerabilities can be exploited remotely by an attacker. It is crucial to update the kernel-tools-libs-devel package to the latest version to mitigate the risk of remote exploitation.
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your AlmaLinux 8 operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for kernel-tools-libs-devel.
