Moderate: virt:rhel security update
Summary
ALSA-2020:0279: Moderate: virt:rhel security update. Affects libiscsi across 3 version ranges.
< 1.18.0-8.module_el8.3.0+2048+e7a0a3ea
< 1.18.0-8.module_el8.5.0+2608+72063365
< 1.18.0-8.module_el8.6.0+2880+7d9e3703
Fixed in 1.18.0-8.module_el8.3.0+2048+e7a0a3ea, 1.18.0-8.module_el8.5.0+2608+72063365 or 1.18.0-8.module_el8.6.0+2880+7d9e3703, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The virt:rhel module is a collection of packages that provide user-space components for running virtual machines using Kernel-based Virtual Machine (KVM) on Linux. These packages also offer APIs for managing and interacting with the virtualized systems.
Vulnerability Detail
The vulnerability in the virt:rhel module is related to the TSX Transaction Asynchronous Abort (TAA) issue (CVE-2019-11135). This vulnerability can have moderate impact and may allow attackers to execute arbitrary code or access sensitive information. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is not provided.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libiscsi-
< 1.18.0-8.module_el8.3.0+2048+e7a0a3ea1.18.0-8.module_el8.3.0+2048+e7a0a3ea -
< 1.18.0-8.module_el8.5.0+2608+720633651.18.0-8.module_el8.5.0+2608+72063365 -
< 1.18.0-8.module_el8.6.0+2880+7d9e37031.18.0-8.module_el8.6.0+2880+7d9e3703
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround is mentioned for this vulnerability.
Conclusion
In conclusion, the virt:rhel module in the affected packages has a moderate security vulnerability related to the TSX Transaction Asynchronous Abort (TAA) issue. It is recommended to update the packages to the fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libiscsi →
FAQ
This vulnerability can allow attackers to execute arbitrary code or access sensitive information.
The CVSS score for this vulnerability is not provided.
To fix this vulnerability, update the affected packages to the fixed versions.
No workaround is mentioned for this vulnerability.
More information about this vulnerability can be found in the CVE page(s) listed in the 'References' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for libiscsi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
