Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Red Hat Enterprise: RHSA-2023:2757-01 Moderate: virt Module Update

red hat
Calendar Grey May 16, 2023
Dist Redhat Esm H88
Oracle has released a patch for db:enterprise and db-devel:enterprise components, mitigating moderate-level vulnerabilities.
An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.
Security Fix(es):
* ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-46790)
* QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165)
* ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value (CVE-2022-30784)
* ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate (CVE-2022-30786)
* ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc (CVE-2022-30788)
* ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array (CVE-2022-30789)
* tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory buffer overflow moderate severity Red Hat Enterprise KVM update virtualization fix virt module

References

https://access.redhat.com/security/cve/CVE-2021-46790 https://access.redhat.com/security/cve/CVE-2022-3165 https://access.redhat.com/security/cve/CVE-2022-30784 https://access.redhat.com/security/cve/CVE-2022-30786 https://access.redhat.com/security/cve/CVE-2022-30788 https://access.redhat.com/security/cve/CVE-2022-30789 https://access.redhat.com/security/cve/CVE-2023-1018 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: SLOF-20210217-1.module+el8.8.0+16781+9f4724c2.src.rpm hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.src.rpm libguestfs-1.44.0-9.module+el8.8.0+16781+9f4724c2.src.rpm libguestfs-winsupport-8.8-1.module+el8.8.0+16781+9f4724c2.src.rpm libiscsi-1.18.0-8.module+el8.8.0+16781+9f4724c2.src.rpm libnbd-1.6.0-5.module+el8.8.0+16781+9f4724c2.src.rpm libtpms-0.9.1-2.20211126git1ff6fe1f43.module+el8.8.0+18453+e0bf0d1d.src.rpm libvirt-8.0.0-19.module+el8.8.0+18453+e0bf0d1d.src.rpm libvirt-dbus-1.3.0-2.module+el8.8.0+16781+9f4724c2.src.rpm libvirt-python-8.0.0-2.module+el8.8.0+16781+9f4724c2.src.rpm nbdkit-1.24.0-5.module+el8.8.0+17308+05924798.src.rpm netcf-0.2.8-12.module+el8.8.0+16781+9f4724c2.src.rpm perl-Sys-Virt-8.0.0-1.module+el8.8.0+16781+9f4724c2.src.rpm qemu-kvm-6.2.0-32.module+el8.8.0+18361+9f407f6e.src.rpm seabios-1.16.0-3.module+el8.8.0+16781+9f4724c2.src.rpm sgabios-0.20170427git-3.module+el8.8.0+16781+9f4724c2.src.rpm supermin-5.2.1-2.module+el8.8.0+16781+9f4724c2.src.rpm swtpm-0.7.0-4.20211109gitb79fd91.module+el8.8.0+16781+9f4724c2.src.rpm virt-v2v-1.42.0-22.module+el8.8.0+18611+5846c3aa.src.rpm
aarch64: hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.aarch64.rpm

Read the Full Advisory


Advisory ID: RHSA-2023:2757-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2757
Issue date: 2023-05-16

Topic

An update for the virt:rhel and virt-devel:rhel modules is now availablefor Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory buffer overflow moderate severity Red Hat Enterprise KVM update virtualization fix virt module

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2018885 - [virtiofs] virtiofsd debug log's timestamp is NULL

2074205 - while live-migrating many instances concurrently, libvirt sometimes return internal error: migration was active, but no RAM info was set

2090990 - qemu crash with error scsi_req_unref(SCSIRequest *): Assertion `req->refcount > 0' failed or scsi_dma_complete(void *, int): Assertion `r->req.aiocb != NULL' failed [8.7.0]

2093314 - CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

2093326 - CVE-2022-30786 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate

2093340 - CVE-2022-30788 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc

2093348 - CVE-2022-30789 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array

2093358 - CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck

2117149 - Can't run when memory backing with hugepages and backend type memfd

2123196 - libvirt kills virtual machine on restart when 2M and 1G hugepages are mounted

2124757 - RHEL8: skey test in kvm_unit_test got failed

2125119 - Mirror job with "copy-mode":"write-blocking" that used for storage migration can't converge under heavy I/O

2128225 - [s390x] [RHEL8][s390x-ccw bios] lacking document about parameter loadparm in qemu

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here