Stay Secure with the Latest Linux Advisories

security advisoryRed Hatbuffer overflow

Red Hat: RHSA-2022-0540-01 Critical: Local Privilege Escalation Issue

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Virtualization Host security update [ovirt-4.4.10-1] Advisory ID: RHSA-2022:0540-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2022:0540 Issue date: 2022-02-15 CVE Names: CVE-2021-4034 CVE-2021-4155 CVE-2021-45417 CVE-2022-0185 ==================================================================== 1. Summary: An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: RHEL 8-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64 Red Hat Virtualization 4 Hypervisor for RHEL 8 - x86_64 3. Description: The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to theCVE page(s) listed in the References section. Security Fix(es): * polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector (CVE-2021-4034) * kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL (CVE-2021-4155) * aide: heap-based buffer overflow on outputs larger than B64_BUF (CVE-2021-45417) * kernel: fs_context: heap overflow in legacy parameter handling (CVE-2022-0185) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Rebased wget package and its dependencies for the same version shipped with recent RHEL. (BZ#2030082) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 5. Bugs fixed (https://bugzilla.redhat.com/): 2025869 - CVE-2021-4034 polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector 2030082 - Failed dependencies occur during install wget package from rhvh optional channel. 2034685 - RHVH 4.4.9 - host upgrade fails with error for package libsmbclient 2034813 - CVE-2021-4155 kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL 2040358 - CVE-2022-0185 kernel: fs_context: heap overflow in legacy parameter handling 2041489 - CVE-2021-45417 aide: heap-based buffer overflow on outputs larger than B64_BUF 6. Package List: Red Hat Virtualization 4 Hypervisor for RHEL 8: Source: libmetalink-0.1.3-7.el8.src.rpm redhat-virtualization-host-4.4.10-202202081536_8.5.src.rpm wget-1.19.5-10.el8.src.rpm x86_64: libmetalink-0.1.3-7.el8.x86_64.rpm libmetalink-debuginfo-0.1.3-7.el8.x86_64.rpm libmetalink-debugsource-0.1.3-7.el8.x86_64.rpm libmetalink-devel-0.1.3-7.el8.x86_64.rpm redhat-virtualization-host-image-update-4.4.10-202202081536_8.5.x86_64.rpm wget-1.19.5-10.el8.x86_64.rpm wget-debuginfo-1.19.5-10.el8.x86_64.rpm wget-debugsource-1.19.5-10.el8.x86_64.rpm RHEL8-based RHEV-H for RHEV 4 (build requirements): Source: redhat-release-virtualization-host-4.4.10-1.el8ev.src.rpm noarch: redhat-virtualization-host-image-update-placeholder-4.4.10-1.el8ev.noarch.rpm x86_64: redhat-release-virtualization-host-4.4.10-1.el8ev.x86_64.rpm redhat-release-virtualization-host-content-4.4.10-1.el8ev.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-4034 https://access.redhat.com/security/cve/CVE-2021-4155 https://access.redhat.com/security/cve/CVE-2021-45417 https://access.redhat.com/security/cve/CVE-2022-0185 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYgvV4tzjgjWX9erEAQgrTw//UyEXmSv91Q+2ZJM3z97/ReIvuDObtzWv Ego1ZinGY27kN7gikxo16bf7RtrYKMXS/fcutF/y0GDvXJEV8NZc+s9oc1hJU0WO 4/xmHLl7keXx4V9Vy7Sye+Sx6XFD3EyZ/w8a54BfUp5NixnVVe7KjiGlV56fDa+4 3m8XeGFhVzSXkZz2sCvhP0+FXVS70nDf5fmzloQZJXcdpNXkhppW9haRhbzT76au SsOw6oAg+3knfo9sUxbyS929VLBetPrx+4S49kufjHLxSPRQWI4B31Sxo7XKpqCH /0K9jCymwkPEV7yMepnJhEKRNWAA8MSRaCMt663WgE8WoT9f65WjOAChlKG9p6D9 pYZg+15sUMUI3waNuYIP4Z42HqmO+BBYaK24qEnoZIvhmegGveMhYV57NFa3kEwb FKg63q2F2e1dx/xj4CfHULcfWrOcvuqnyHBZYIzUwgXhnisUIVI6xk0j9z0JooYS s60rmWyKEYAzSkG+gvFcHiRhnTqQAXsG+wZ/yqltuQWA+aigVRv0mBxmFdxKweg/ Um61I8iTSgg1W5EzReFIsviCw+XMLFbM63Dr7un4KWc2xewdsD2XraYGhhCWhdtv JDpRCjCsDCu4YwOvr4t8PCDFGZtC/sE0HMFZwbNmgOpNzNLL6pCgR+MAroQz244h dDBjmVXLRIM=rIrP -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical update for Red Hat Virtualization Hosts resolves numerous CVEs, introducing major security enhancements.. Red Hat Virtualization, SecurityUpdate, Vulnerability Management. . Severity: Important. LinuxSecurity.com Team

Feb 15, 2022 •Important Red Hat