Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 456
Alerts This Week
Warning Icon 1 456

RedHat: RHSA-2023:5405 Low: Virt:AV Buffer Overflow Update

red hat
Calendar Grey September 28, 2023
Dist Redhat Esm H88
A minor critical patch for virt:av and virt-devel:av addresses a memory overflow issue in Red Hat 8.4.0.
An update for the virt:av and virt-devel:av modules is now available for Advanced Virtualization for RHEL 8.4.0.EUS

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image (CVE-2022-40284)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat buffer overflow low severity virtualization update RHEL 8 Virt:AV

References

https://access.redhat.com/security/cve/CVE-2022-40284 https://access.redhat.com/security/updates/classification/#low

Package List

Advanced Virtualization for RHEL 8.4.0.EUS:
Source: SLOF-20200717-1.gite18ddad8.module+el8.4.0+8855+a9e237a9.src.rpm SLOF-20200717-1.gite18ddad8.module+el8.4.0+8855+a9e237a9.src.rpm hivex-1.3.18-21.module+el8.4.0+11609+2eba841a.src.rpm libguestfs-1.44.0-2.module+el8.4.0+10146+75917d2f.src.rpm libguestfs-winsupport-8.4-1.module+el8.4.0+19819+df446cdf.src.rpm libiscsi-1.18.0-8.module+el8.4.0+8855+a9e237a9.src.rpm libnbd-1.6.0-5.module+el8.4.0+14155+dec4a5c7.src.rpm libtpms-0.7.4-4.20201106git2452a24dab.module+el8.4.0+10596+32ba7df3.src.rpm libvirt-7.0.0-14.8.module+el8.4.0+15255+f7eff4dd.src.rpm libvirt-dbus-1.3.0-2.module+el8.4.0+8855+a9e237a9.src.rpm libvirt-python-7.0.0-1.module+el8.4.0+9469+2eaf72bc.src.rpm nbdkit-1.24.0-1.module+el8.4.0+9341+96cf2672.src.rpm netcf-0.2.8-12.module+el8.4.0+8855+a9e237a9.src.rpm perl-Sys-Virt-7.0.0-1.module+el8.4.0+9469+2eaf72bc.src.rpm python-pyvmomi-6.7.1-7.module+el8.4.0+8855+a9e237a9.src.rpm qemu-kvm-5.2.0-16.module+el8.4.0+18177+78c83690.19.src.rpm seabios-1.14.0-1.module+el8.4.0+8855+a9e237a9.src.rpm seabios-1.14.0-1.module+el8.4.0+8855+a9e237a9.src.rpm sgabios-0.20170427git-3.module+el8.4.0+8855+a9e237a9.src.rpm sgabios-0.20170427git-3.module+el8.4.0+8855+a9e237a9.src.rpm supermin-5.2.1-1.module+el8.4.0+9751+d56db353.src.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2023:5405-01
Product: Advanced Virtualization
Advisory URL: Issue date: 2023-09-28

Topic

An update for the virt:av and virt-devel:av modules is now available forAdvanced Virtualization for RHEL 8.4.0.EUS.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat buffer overflow low severity virtualization update RHEL 8 Virt:AV

Relevant Releases Architectures

Advanced Virtualization for RHEL 8.4.0.EUS - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

2236130 - CVE-2022-40284 NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.