Cybersecurity specialists report the detection of three critical vulnerabilities in virtualization solutions developed by the technology company Red Hat. According to the report, the successful exploitation of the vulnerabilities would allow threat actors to deploy denial of service (DoS) attacks, privilege escalation and other risk scenarios.
Below are brief descriptions of the reported flaws, as well as the respective tracking keys and scores according to the Common Vulnerability Scoring System (CVSS).
CVE-2020-24489: The incomplete cleanup on the affected implementations leads to a security restriction bypassing condition and to privilege escalation attacks.
The failure received a CVSS score of 6.8 / 10, which is why it is considered a low severity error.
CVE-2021-25217: The inadequate validation of options data stored in DHCP leases allows remote threat actors to pass specially crafted input to the affected applications.
The vulnerability received a CVSS score of 4.7/10 and its exploitation would allow hackers to deploy DoS conditions over the affected system.
CVE-2021-27219: The integer overflow within the gbytes_new() function on 64-bit platforms due to an implicit cast from 64-bit to 32-bit allows local users to run a specially crafted program to trigger an integer overflow and execute arbitrary code with elevated privileges.
The vulnerability received a 4.6/10 score and would allow local threat actors to escalate privileges on the target system.
The flaws reside in the following products and versions:
- redhat-virtualization-host (Red Hat package): 4.3.11-20200922.0.el7_9, 4.3.12-20201216.0.el7_9, 4.3.13-20210127.0.el7_9, 4.3.14-20210322.0.el7_9
- redhat-release-virtualization-host (Red Hat package): 4.3.4-1.el7ev, 4.3.5-2.el7ev, 4.3.5-4.el7ev, 4.3.6-2.el7ev, 4.3.6-5.el7ev, 4.3.9-2.el7ev, 4.3.11-1.el7ev, 4.3.12-4.el7ev, 4.3.13-2.el7ev, 4.3.14-2.el7ev
- Red Hat Virtualization Host: 4
- Red Hat Virtualization: 4
Although some of these flaws can be exploited by unauthenticated remote threat actors, experts have not detected exploit attempts in real scenarios or the existence of a variant of malware associated with the attack. The updates are available now, so Red Hat encourages users of affected deployments to correct as soon as possible.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
