Advisory ROSA-SA-2024-2355

Software: libvirt 6.0.0
OS: ROSA Virtualization 2.1

package_evr_string: libvirt-6.0.0-28.module+el8.3.0+7827+5e65edd7.src.rpm

CVE-ID: CVE-2020-14339
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: A vulnerability was discovered in libvirt that caused the /dev/mapper/control file descriptor to be exposed to the QEMU process. This file descriptor allows privileged operations to be performed on the device mapper on the host. This flaw allows a malicious guest user or process to perform operations beyond its default permissions, which could result in severe damage to the host operating system. The greatest threat from this vulnerability is to the confidentiality, integrity, as well as availability of the system.
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update libvirt command