Moderate: kernel security and bug fix update in kernel-tools-libs-devel
Summary
ALSA-2021:5227: Moderate: kernel security and bug fix update. Affects kernel-tools-libs-devel versions < 4.18.0-348.7.1.el8_5. Fixed in 4.18.0-348.7.1.el8_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel is the core component of any Linux operating system. It provides essential functionality and interfaces for the system's hardware and software components. The kernel-tools-libs-devel package is a development library for kernel tools in AlmaLinux 8. This package is used for building and developing kernel-related applications and utilities.
Vulnerability Detail
This vulnerability, identified as CVE-2021-20321, affects the Overlayfs feature in the Linux kernel. It arises from a missing check for a negative dentry before calling vfs_rename(). Exploiting this vulnerability could lead to various security issues, potentially allowing an attacker to gain unauthorized access, escalate privileges, or cause denial-of-service conditions. The impact and severity of the vulnerability are assessed using the Common Vulnerability Scoring System (CVSS). More information about this vulnerability can be found in the CVE page referenced in the 'References' section.
How To Fix
Minimum fixed version
4.18.0-348.7.1.el8_5
This is the first release that contains the fix.
sudo dnf update kernel-tools-libs-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and update the affected package to the latest version.
Conclusion
In conclusion, the kernel-tools-libs-devel package in AlmaLinux 8 is affected by a moderate-level vulnerability (CVE-2021-20321) in the Overlayfs feature. To mitigate this vulnerability, it is recommended to update the package to version 4.18.0-348.7.1.el8_5 or later. Regularly applying security updates and following best practices will help ensure the security and stability of your systems. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for kernel-tools-libs-devel →
FAQ
This vulnerability could potentially allow an attacker to gain unauthorized access, escalate privileges, or cause denial-of-service conditions on affected systems.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit available for this vulnerability. However, it is crucial to apply the recommended fix and keep your systems up to date to mitigate any potential risks.
In addition to applying the necessary updates, it is always advisable to follow security best practices such as regularly updating all software components, implementing strong access controls, and monitoring system logs for any suspicious activities.
You can find more detailed information about this vulnerability, including its technical aspects and impact, on the CVE page referenced in the 'References' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for kernel-tools-libs-devel.
