Incorrect Permission Assignment for Critical Resource Affecting libvirt-daemon-driver-storage-scsi package, versions <0:5.7.0-38.el7
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE7-LIBVIRTDAEMONDRIVERSTORAGESCSI-3159885
- published 10 Apr 2022
- disclosed 2 Mar 2022
Introduced: 2 Mar 2022
CVE-2021-3631 Open this link in a new tabHow to fix?
Upgrade Oracle:7 libvirt-daemon-driver-storage-scsi to version 0:5.7.0-38.el7 or higher.
This issue was patched in ELSA-2022-10062.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libvirt-daemon-driver-storage-scsi package and not the libvirt-daemon-driver-storage-scsi package as distributed by Oracle.
See How to fix? for Oracle:7 relevant fixed versions and status.
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
References
- https://linux.oracle.com/cve/CVE-2021-3631.html
- https://linux.oracle.com/errata/ELSA-2021-4191.html
- https://linux.oracle.com/errata/ELSA-2022-10093.html
- https://linux.oracle.com/errata/ELSA-2023-12108.html
- https://access.redhat.com/errata/RHSA-2021:3631
- https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2
- https://bugzilla.redhat.com/show_bug.cgi?id=1977726
- https://gitlab.com/libvirt/libvirt/-/issues/153
- https://security.netapp.com/advisory/ntap-20220331-0010/
- https://security.gentoo.org/glsa/202210-06
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html