Incorrect Permission Assignment for Critical Resource Affecting qemu-img package, versions <15:4.2.0-59.module+el8.5.0+20410+46b2d321


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.06% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-QEMUIMG-2591818
  • published10 Apr 2022
  • disclosed2 Mar 2022

Introduced: 2 Mar 2022

CVE-2021-3631  (opens in a new tab)
CWE-732  (opens in a new tab)

How to fix?

Upgrade Oracle:8 qemu-img to version 15:4.2.0-59.module+el8.5.0+20410+46b2d321 or higher.
This issue was patched in ELSA-2021-4191.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu-img package and not the qemu-img package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS Scores

version 3.1