RHSA-2022:0443HighCVSS 8.1

Red Hat Security Advisory: RHV-H security update (redhat-virtualization-host) 4.3.21

Published
February 7, 2022
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2021-4034 →CVE-2020-25717 →

📋 Description

CVE-2020-25717 — samba: Active Directory (AD) domain user could become root on domain members CVE-2021-4034 — polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

🎯 Affected products9

  • RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Virtualization 4 Hypervisor for RHEL 7
  • redhat-release-virtualization-host-0:4.3.21-1.el7ev.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-0:4.3.21-1.el7ev.x86_64 as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.3.21-20220126.0.el7_9.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.3.21-20220126.0.el7_9.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7
  • redhat-virtualization-host-image-update-0:4.3.21-20220126.0.el7_9.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-image-update-0:4.3.21-20220126.0.el7_9.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7
  • redhat-virtualization-host-image-update-placeholder-0:4.3.21-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 Workaround: Setting "gensec:require_pac=true" in the smb.conf makes, due to a cache prime in winbind, the DOMAIN\user lookup succeed, provided nss_winbind is in use, 'winbind use default domain = no' (the default) and no error paths are hit. It would be prudent to pre-create disabled users in Active Directory matching on all privileged names not held in Active Directory, eg ~~~ samba-tool user add root -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password samba-tool user add ubuntu -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password ~~~ (repeat for eg all system users under 1000 in /etc/passwd or special to any other AD-connected services, eg perhaps "admin" for a web-app) Workaround: For customers who cannot update immediately and doesn't have Secure Boot feature enabled, the issue can be mitigated by executing the following steps: 1) Install required systemtap packages and dependencies as per - pointed by https://access.redhat.com/solutions/5441 2) Install polkit debug info: ~~~ debuginfo-install polkit ~~~ 3) Create the following systemtap script, and name it pkexec-block.stp: ~~~ probe process("/usr/bin/pkexec").function("main") { if (cmdline_arg(1) == "") raise(9); } ~~~ 4) Load the systemtap module into the running kernel: ~~~ stap -g -F -m stap_pkexec_block pkexec_block.stp ~~~ 5) Ensure the module is loaded: ~~~ lsmod | grep -i stap_pkexec_block stap_pkexec_block 434176 0 ~~~ 6) Once polkit package was updated to the version containing the fix, the systemtap generated kernel module can be removed by running: ~~~ rmmod stap_pkexec_block ~~~ This mitigation doesn't work for Secure Boot enabled system as SystemTap would require an external compiling server to be able to sign the generated kernel module with a key enrolled into the Kernel's keyring.

🔗 References (6)