Rocky Linux 8 [CIQ] Security Update: kexec-tools / kexec-tools-debuginfo / kexec-tools-debugsource (crlsa-2021_4404)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214404 advisory. kexec-tools: incorrect permissions on kdump dmesg file CVE-2021-20269 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Denial Of Service (DoS)

kexec-tools is vulnerable to denial of service. An attacker can crash the application when kdump generates the dmesg file with incorrect permissions...

kexec-tools: incorrect permissions on kdump dmesg file

A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality...