Veracode Vulnerability DatabaseVERACODE:24770Authorization Bypass
EPSS
Percentile
5.1%
kernel is vulnerable to authorization bypass. In KVM (Kernel-based Virtual Machine) environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests (and other SCSI commands) on the host, and possibly access the data of other guests that reside on the same underlying block device. Partition-based and LVM-based storage pools are not used by default. Refer to Red Hat Bugzilla bug 752375 for further details and a mitigation script for users who cannot apply this update immediately.
References
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0bfc96cb77224736dfa35c3c555d37b3646ef35e
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec8013beddd717d1740cfefb1a9b900deef85462
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0bfc96cb77224736dfa35c3c555d37b3646ef35e
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec8013beddd717d1740cfefb1a9b900deef85462
lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html
lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
secunia.com/advisories/48898
www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.2
www.openwall.com/lists/oss-security/2011/12/22/5
access.redhat.com/errata/RHSA-2011:1849
access.redhat.com/errata/RHSA-2011:1850
access.redhat.com/errata/RHSA-2012:0107
access.redhat.com/errata/RHSA-2012:0333
access.redhat.com/errata/RHSA-2012:0358
access.redhat.com/security/cve/CVE-2011-4127
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=752375
github.com/torvalds/linux/commit/0bfc96cb77224736dfa35c3c555d37b3646ef35e
github.com/torvalds/linux/commit/ec8013beddd717d1740cfefb1a9b900deef85462
Related
