Important: virt:rhel security update
Summary
ALSA-2020:4059: Important: virt:rhel security update. Affects libiscsi across 3 version ranges.
< 1.18.0-8.module_el8.3.0+2048+e7a0a3ea
< 1.18.0-8.module_el8.5.0+2608+72063365
< 1.18.0-8.module_el8.6.0+2880+7d9e3703
Fixed in 1.18.0-8.module_el8.3.0+2048+e7a0a3ea, 1.18.0-8.module_el8.5.0+2608+72063365 or 1.18.0-8.module_el8.6.0+2880+7d9e3703, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The virt:rhel module is a component of the Kernel-based Virtual Machine (KVM) that provides user-space components for running virtual machines using KVM. It also offers APIs for managing and interacting with the virtualized systems. This module is widely used on various hardware platforms to provide a full virtualization solution for Linux.
The vulnerability affects the libiscsi, libiscsi-devel, libiscsi-utils, netcf, netcf-devel, netcf-libs, sgabios, and sgabios-bin packages in AlmaLinux 8. These packages are used in conjunction with the virt:rhel module and are responsible for providing additional functionality and libraries for virtualization.
The vulnerability allows for out-of-bounds read and write access issues while processing USB packets and networking, which can lead to information disclosure and potential remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2020-14364 and CVE-2020-10756, affects the virt:rhel module in AlmaLinux 8. It arises from out-of-bounds read and write access issues in the USB packet processing and networking components of the QEMU virtualization software.
The USB packet processing vulnerability (CVE-2020-14364) can be exploited by an attacker to gain unauthorized access to sensitive information or execute arbitrary code on the host system. The networking vulnerability (CVE-2020-10756) allows for information disclosure, potentially exposing sensitive data to unauthorized parties.
These vulnerabilities have been assigned a CVSS score, which indicates their severity and impact on the affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libiscsi-
< 1.18.0-8.module_el8.3.0+2048+e7a0a3ea1.18.0-8.module_el8.3.0+2048+e7a0a3ea -
< 1.18.0-8.module_el8.5.0+2608+720633651.18.0-8.module_el8.5.0+2608+72063365 -
< 1.18.0-8.module_el8.6.0+2880+7d9e37031.18.0-8.module_el8.6.0+2880+7d9e3703
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The virt:rhel module in AlmaLinux 8 is vulnerable to out-of-bounds read and write access issues in the USB packet processing and networking components of the QEMU virtualization software. These vulnerabilities can lead to unauthorized access, potential remote code execution, and information disclosure. To mitigate the risk, it is crucial to update the affected packages to the fixed versions provided. After updating, it is recommended to restart any affected services or reboot the system.
For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libiscsi →
FAQ
The virt:rhel module is a component of the Kernel-based Virtual Machine (KVM) that provides user-space components for running virtual machines using KVM. It also offers APIs for managing and interacting with the virtualized systems.
The vulnerabilities can lead to unauthorized access to sensitive information, potential remote code execution, and information disclosure.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is important to apply the necessary updates to mitigate the risk.
To update the affected packages, use the package manager of your AlmaLinux 8 system, such as yum or dnf, and run the appropriate command with root privileges. For example:
sudo yum update libiscsi libiscsi-devel libiscsi-utils
After updating the packages, it is recommended to restart any affected services or reboot the system to ensure the changes take effect.
Related vulnerabilities
Recent vulnerabilities recorded for libiscsi.
