Authorization Bypass

2020-04-1001:03:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

JSON

kernel is vulnerable to authorization bypass. In KVM (Kernel-based Virtual Machine) environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests (and other SCSI commands) on the host, and possibly access the data of other guests that reside on the same underlying block device. Partition-based and LVM-based storage pools are not used by default. Refer to Red Hat Bugzilla bug 752375 for further details and a mitigation script for users who cannot apply this update immediately.

CPENameOperatorVersion
kerneleq2.6.18__128.1.1.el5
kerneleq2.6.18__8.1.6.el5
kerneleq2.6.18__53.1.21.el5
kerneleq2.6.18__128.1.14.el5
kerneleq2.6.32__131.21.1.el6
kerneleq2.6.18__164.11.1.el5
kerneleq2.6.18__194.26.1.el5
kerneleq2.6.18__8.1.15.el5
kerneleq2.6.18__128.30.1.el5
kerneleq2.6.32__131.17.1.el6

Name	Operator	Version
kernel	eq	2.6.18__128.1.1.el5
kernel	eq	2.6.18__8.1.6.el5
kernel	eq	2.6.18__53.1.21.el5
kernel	eq	2.6.18__128.1.14.el5
kernel	eq	2.6.32__131.21.1.el6
kernel	eq	2.6.18__164.11.1.el5
kernel	eq	2.6.18__194.26.1.el5
kernel	eq	2.6.18__8.1.15.el5
kernel	eq	2.6.18__128.30.1.el5
kernel	eq	2.6.32__131.17.1.el6