Improper Privilege Management Affecting supermin-debugsource package, versions <0:5.1.19-10.module+el8.4.0+534+4680a14e


Severity

Recommended
0.0
high
0
10

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
0.06% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Privilege Management vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ROCKY8-SUPERMINDEBUGSOURCE-3296696
  • published3 Feb 2023
  • disclosed28 Jan 2021

Introduced: 28 Jan 2021

CVE-2020-35517  (opens in a new tab)
CWE-269  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:8 supermin-debugsource to version 0:5.1.19-10.module+el8.4.0+534+4680a14e or higher.
This issue was patched in RLSA-2021:0711.

NVD Description

Note: Versions mentioned in the description apply only to the upstream supermin-debugsource package and not the supermin-debugsource package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:8 relevant fixed versions and status.

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices.

CVSS Scores

version 3.1