This would not be the first time Red Hat’s Enterprise Linux products experienced software vulnerabilities, and also would not be the first time a WebKit security flaw caused other security incidents.
About Red Hat and Linux
Red Hat, Inc. is a multi-billion dollar IBM subsidiary company that provides open-source software. Established in 1993, Red Hat offers a vast range of products, such as; platforms, storage, application services, application development, cloud computing solutions, and automation/management solutions. Enterprise Linux 8 is Red Hat’s flagship open-source operating system solution for hybrid cloud environments.
The Exploited Vulnerability
Vulnerability CVE-2021-30858 affecting the webkit2gtk3 (WebKitGTK) is a ‘Use-after-free’, high-risk security flaw. The webkit2gtk3 – WebKitGTK is a port of the portable web rendering engine relating to the GTK platform. The vulnerability has been confirmed as being actively exploited by malicious threat actors, and ultimately leads to a compromise of a vulnerable (unpatched) system.
Technical Analysis
The vulnerability allows a remote attacker to compromise vulnerable systems and exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system. Successful exploitation of the vulnerability may allow an attacker to compromise a vulnerable system.
Vulnerable Software Versions
The following versions of the Red Hat Enterprise Linux Server are vulnerable;
Important Information For Users
It is important to know that fixes have been made available by Red Hat that should be immediately applied to the abovementioned products. Information on how to apply updates for Red Hat Enterprise Linux 8 can be found on this page under ‘Applying package updates on Red Hat Enterprise Linux 8.’
