ALSA-2021:4056 - Kernel Security, Bug Fix, and Enhancement Update
Summary
ALSA-2021:4056: Important: kernel security, bug fix, and enhancement update. Affects kernel-tools-libs-devel versions < 4.18.0-305.25.1.el8_4. Fixed in 4.18.0-305.25.1.el8_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel is the core component of any Linux operating system. It provides essential functionality and interfaces for hardware, software, and user applications. The kernel packages contain the Linux kernel and are responsible for managing system resources, handling device drivers, and facilitating communication between different components of the operating system.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the kernel:
-
CVE-2020-36385: A use-after-free vulnerability in drivers/infiniband/core/ucma.c could be exploited to execute arbitrary code or cause a denial of service.
-
CVE-2021-0512: An out-of-bounds write vulnerability in hid-input.c could lead to a heap buffer overflow, potentially allowing an attacker to execute arbitrary code or crash the system.
-
CVE-2021-3656: A vulnerability in the SVM nested virtualization feature of KVM could allow a guest VM to escalate privileges or crash the host system.
These vulnerabilities pose a significant risk to the security and stability of affected systems. Exploitation of these vulnerabilities could lead to unauthorized access, data breaches, system crashes, or other adverse effects.
How To Fix
Minimum fixed version
4.18.0-305.25.1.el8_4
This is the first release that contains the fix.
sudo dnf update kernel-tools-libs-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in the kernel. It is recommended to update the affected packages to the fixed versions as soon as possible to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for kernel-tools-libs-devel →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code, crash the system, or escalate privileges. They pose a significant risk to the security and stability of affected systems.
The recommended mitigation is to update the kernel packages to the fixed versions. Applying the updates will address the vulnerabilities and reduce the risk of exploitation.
The exact conditions for remote exploitation may vary depending on the specific vulnerability. However, in general, remote exploitation is possible if the attacker can establish a network connection to the vulnerable system.
At the time of this advisory, there is no known evidence of active exploitation of these vulnerabilities. However, it is always recommended to apply security updates promptly to mitigate potential risks.
You can find more information about these vulnerabilities, including their CVSS scores and other related details, on the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-tools-libs-devel.
