ALSA-2022:1759
- Source
- https://errata.almalinux.org/8/ALSA-2022-1759.html
- Import Source
- https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:1759.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALSA-2022:1759
- Related
- Published
- 2022-05-10T07:59:57Z
- Modified
- 2022-05-10T07:59:56Z
- Summary
- Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
- Details
-
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.
The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0), libvirt (8.0.0), libvirt-python (8.0.0), perl-Sys-Virt (8.0.0), seabios (1.15.0), libtpms (0.9.1). (BZ#1997410, BZ#2012802, BZ#2012806, BZ#2012813, BZ#2018392, BZ#2027716, BZ#2029355)
Security Fix(es):
QEMU: virtio-net: heap use-after-free in virtionetreceive_rcu (CVE-2021-3748)
ntfs-3g: Out-of-bounds heap buffer access in ntfsgetattributevalue() due to incorrect check of bytesin_use value in MFT records (CVE-2021-33285)
ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)
ntfs-3g: Heap buffer overflow in ntfsattrpread_i() triggered by specially crafted NTFS attributes (CVE-2021-33287)
ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)
ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)
ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections (CVE-2021-35267)
ntfs-3g: Heap buffer overflow in ntfsinodereal_open() triggered by a specially crafted NTFS inode (CVE-2021-35268)
ntfs-3g: Heap buffer overflow in ntfsattrsetup_flag() triggered by a specially crafted NTFS attribute from MFT (CVE-2021-35269)
ntfs-3g: NULL pointer dereference in ntfsextentinode_open() (CVE-2021-39251)
ntfs-3g: Out-of-bounds read in ntfsielookup() (CVE-2021-39252)
ntfs-3g: Out-of-bounds read in ntfsrunlistsmerge_i() (CVE-2021-39253)
ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfsattrrecord_resize() (CVE-2021-39254)
ntfs-3g: Out-of-bounds read ntfsattrfindinattrdef() triggered by an invalid attribute (CVE-2021-39255)
ntfs-3g: Heap buffer overflow in ntfsinodelookupbyname() (CVE-2021-39256)
ntfs-3g: Endless recursion from ntfsattrpwrite() triggered by an unallocated bitmap (CVE-2021-39257)
ntfs-3g: Out-of-bounds reads in ntfsattrfind() and ntfsexternalattr_find() (CVE-2021-39258)
ntfs-3g: Out-of-bounds access in ntfsinodelookupbyname() caused by an unsanitized attribute length (CVE-2021-39259)
ntfs-3g: Out-of-bounds access in ntfsinodesyncstandardinformation() (CVE-2021-39260)
ntfs-3g: Heap buffer overflow in ntfscompressedpwrite() (CVE-2021-39261)
ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)
ntfs-3g: Heap buffer overflow in ntfsgetattribute_value() caused by an unsanitized attribute (CVE-2021-39263)
libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485)
hivex: stack overflow due to recursive call of getchildren() (CVE-2021-3622)
nbdkit: NBDOPTSTRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716)
libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975)
QEMU: NULL pointer dereference in mirrorwaiton_conflicts() in block/mirror.c (CVE-2021-4145)
QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)
QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- References
-
- https://errata.almalinux.org/8/ALSA-2022-1759.html
- https://vulners.com/cve/CVE-2021-20196
- https://vulners.com/cve/CVE-2021-33285
- https://vulners.com/cve/CVE-2021-33286
- https://vulners.com/cve/CVE-2021-33287
- https://vulners.com/cve/CVE-2021-33289
- https://vulners.com/cve/CVE-2021-35266
- https://vulners.com/cve/CVE-2021-35267
- https://vulners.com/cve/CVE-2021-35268
- https://vulners.com/cve/CVE-2021-35269
- https://vulners.com/cve/CVE-2021-3622
- https://vulners.com/cve/CVE-2021-3716
- https://vulners.com/cve/CVE-2021-3748
- https://vulners.com/cve/CVE-2021-39251
- https://vulners.com/cve/CVE-2021-39252
- https://vulners.com/cve/CVE-2021-39253
- https://vulners.com/cve/CVE-2021-39254
- https://vulners.com/cve/CVE-2021-39255
- https://vulners.com/cve/CVE-2021-39256
- https://vulners.com/cve/CVE-2021-39257
- https://vulners.com/cve/CVE-2021-39258
- https://vulners.com/cve/CVE-2021-39259
- https://vulners.com/cve/CVE-2021-39260
- https://vulners.com/cve/CVE-2021-39261
- https://vulners.com/cve/CVE-2021-39262
- https://vulners.com/cve/CVE-2021-39263
- https://vulners.com/cve/CVE-2021-3975
- https://vulners.com/cve/CVE-2021-4145
- https://vulners.com/cve/CVE-2021-4158
- https://vulners.com/cve/CVE-2022-0485
Affected packages
AlmaLinux:8 / SLOF
Package
- Name
- SLOF
AlmaLinux:8 / hivex
Package
- Name
- hivex
AlmaLinux:8 / hivex-devel
Package
- Name
- hivex-devel
AlmaLinux:8 / libguestfs
Package
- Name
- libguestfs
AlmaLinux:8 / libguestfs-appliance
Package
- Name
- libguestfs-appliance
AlmaLinux:8 / libguestfs-bash-completion
Package
- Name
- libguestfs-bash-completion
AlmaLinux:8 / libguestfs-devel
Package
- Name
- libguestfs-devel
AlmaLinux:8 / libguestfs-gfs2
Package
- Name
- libguestfs-gfs2
AlmaLinux:8 / libguestfs-gobject
Package
- Name
- libguestfs-gobject
AlmaLinux:8 / libguestfs-gobject-devel
Package
- Name
- libguestfs-gobject-devel
AlmaLinux:8 / libguestfs-inspect-icons
Package
- Name
- libguestfs-inspect-icons
AlmaLinux:8 / libguestfs-java
Package
- Name
- libguestfs-java
AlmaLinux:8 / libguestfs-java-devel
Package
- Name
- libguestfs-java-devel
AlmaLinux:8 / libguestfs-javadoc
Package
- Name
- libguestfs-javadoc
AlmaLinux:8 / libguestfs-man-pages-ja
Package
- Name
- libguestfs-man-pages-ja
AlmaLinux:8 / libguestfs-man-pages-uk
Package
- Name
- libguestfs-man-pages-uk
AlmaLinux:8 / libguestfs-rescue
Package
- Name
- libguestfs-rescue
AlmaLinux:8 / libguestfs-rsync
Package
- Name
- libguestfs-rsync
AlmaLinux:8 / libguestfs-tools
Package
- Name
- libguestfs-tools
AlmaLinux:8 / libguestfs-tools-c
Package
- Name
- libguestfs-tools-c
AlmaLinux:8 / libguestfs-winsupport
Package
- Name
- libguestfs-winsupport
AlmaLinux:8 / libguestfs-xfs
Package
- Name
- libguestfs-xfs
AlmaLinux:8 / libiscsi
Package
- Name
- libiscsi
AlmaLinux:8 / libiscsi-devel
Package
- Name
- libiscsi-devel
AlmaLinux:8 / libiscsi-utils
Package
- Name
- libiscsi-utils
AlmaLinux:8 / libnbd
Package
- Name
- libnbd
AlmaLinux:8 / libnbd-bash-completion
Package
- Name
- libnbd-bash-completion
AlmaLinux:8 / libnbd-devel
Package
- Name
- libnbd-devel
AlmaLinux:8 / libtpms
Package
- Name
- libtpms
AlmaLinux:8 / libtpms-devel
Package
- Name
- libtpms-devel
AlmaLinux:8 / libvirt
Package
- Name
- libvirt
AlmaLinux:8 / libvirt-client
Package
- Name
- libvirt-client
AlmaLinux:8 / libvirt-daemon
Package
- Name
- libvirt-daemon
AlmaLinux:8 / libvirt-daemon-config-network
Package
- Name
- libvirt-daemon-config-network
AlmaLinux:8 / libvirt-daemon-config-nwfilter
Package
- Name
- libvirt-daemon-config-nwfilter
AlmaLinux:8 / libvirt-daemon-driver-interface
Package
- Name
- libvirt-daemon-driver-interface
AlmaLinux:8 / libvirt-daemon-driver-network
Package
- Name
- libvirt-daemon-driver-network
AlmaLinux:8 / libvirt-daemon-driver-nodedev
Package
- Name
- libvirt-daemon-driver-nodedev
AlmaLinux:8 / libvirt-daemon-driver-nwfilter
Package
- Name
- libvirt-daemon-driver-nwfilter
AlmaLinux:8 / libvirt-daemon-driver-qemu
Package
- Name
- libvirt-daemon-driver-qemu
AlmaLinux:8 / libvirt-daemon-driver-secret
Package
- Name
- libvirt-daemon-driver-secret
AlmaLinux:8 / libvirt-daemon-driver-storage
Package
- Name
- libvirt-daemon-driver-storage
AlmaLinux:8 / libvirt-daemon-driver-storage-core
Package
- Name
- libvirt-daemon-driver-storage-core
AlmaLinux:8 / libvirt-daemon-driver-storage-disk
Package
- Name
- libvirt-daemon-driver-storage-disk
AlmaLinux:8 / libvirt-daemon-driver-storage-gluster
Package
- Name
- libvirt-daemon-driver-storage-gluster
AlmaLinux:8 / libvirt-daemon-driver-storage-iscsi
Package
- Name
- libvirt-daemon-driver-storage-iscsi
AlmaLinux:8 / libvirt-daemon-driver-storage-iscsi-direct
Package
- Name
- libvirt-daemon-driver-storage-iscsi-direct
AlmaLinux:8 / libvirt-daemon-driver-storage-logical
Package
- Name
- libvirt-daemon-driver-storage-logical
AlmaLinux:8 / libvirt-daemon-driver-storage-mpath
Package
- Name
- libvirt-daemon-driver-storage-mpath
AlmaLinux:8 / libvirt-daemon-driver-storage-rbd
Package
- Name
- libvirt-daemon-driver-storage-rbd
AlmaLinux:8 / libvirt-daemon-driver-storage-scsi
Package
- Name
- libvirt-daemon-driver-storage-scsi
AlmaLinux:8 / libvirt-daemon-kvm
Package
- Name
- libvirt-daemon-kvm
AlmaLinux:8 / libvirt-dbus
Package
- Name
- libvirt-dbus
AlmaLinux:8 / libvirt-devel
Package
- Name
- libvirt-devel
AlmaLinux:8 / libvirt-docs
Package
- Name
- libvirt-docs
AlmaLinux:8 / libvirt-libs
Package
- Name
- libvirt-libs
AlmaLinux:8 / libvirt-lock-sanlock
Package
- Name
- libvirt-lock-sanlock
AlmaLinux:8 / libvirt-nss
Package
- Name
- libvirt-nss
AlmaLinux:8 / libvirt-wireshark
Package
- Name
- libvirt-wireshark
AlmaLinux:8 / lua-guestfs
Package
- Name
- lua-guestfs
AlmaLinux:8 / nbdfuse
Package
- Name
- nbdfuse
AlmaLinux:8 / nbdkit
Package
- Name
- nbdkit
AlmaLinux:8 / nbdkit-bash-completion
Package
- Name
- nbdkit-bash-completion
AlmaLinux:8 / nbdkit-basic-filters
Package
- Name
- nbdkit-basic-filters
AlmaLinux:8 / nbdkit-basic-plugins
Package
- Name
- nbdkit-basic-plugins
AlmaLinux:8 / nbdkit-curl-plugin
Package
- Name
- nbdkit-curl-plugin
AlmaLinux:8 / nbdkit-devel
Package
- Name
- nbdkit-devel
AlmaLinux:8 / nbdkit-example-plugins
Package
- Name
- nbdkit-example-plugins
AlmaLinux:8 / nbdkit-gzip-filter
Package
- Name
- nbdkit-gzip-filter
AlmaLinux:8 / nbdkit-gzip-plugin
Package
- Name
- nbdkit-gzip-plugin
AlmaLinux:8 / nbdkit-linuxdisk-plugin
Package
- Name
- nbdkit-linuxdisk-plugin
AlmaLinux:8 / nbdkit-nbd-plugin
Package
- Name
- nbdkit-nbd-plugin
AlmaLinux:8 / nbdkit-python-plugin
Package
- Name
- nbdkit-python-plugin
AlmaLinux:8 / nbdkit-server
Package
- Name
- nbdkit-server
AlmaLinux:8 / nbdkit-ssh-plugin
Package
- Name
- nbdkit-ssh-plugin
AlmaLinux:8 / nbdkit-tar-filter
Package
- Name
- nbdkit-tar-filter
AlmaLinux:8 / nbdkit-tar-plugin
Package
- Name
- nbdkit-tar-plugin
AlmaLinux:8 / nbdkit-tmpdisk-plugin
Package
- Name
- nbdkit-tmpdisk-plugin
AlmaLinux:8 / nbdkit-vddk-plugin
Package
- Name
- nbdkit-vddk-plugin
AlmaLinux:8 / nbdkit-xz-filter
Package
- Name
- nbdkit-xz-filter
AlmaLinux:8 / netcf
Package
- Name
- netcf
AlmaLinux:8 / netcf-devel
Package
- Name
- netcf-devel
AlmaLinux:8 / netcf-libs
Package
- Name
- netcf-libs
AlmaLinux:8 / ocaml-hivex
Package
- Name
- ocaml-hivex
AlmaLinux:8 / ocaml-hivex-devel
Package
- Name
- ocaml-hivex-devel
AlmaLinux:8 / ocaml-libguestfs
Package
- Name
- ocaml-libguestfs
AlmaLinux:8 / ocaml-libguestfs-devel
Package
- Name
- ocaml-libguestfs-devel
AlmaLinux:8 / ocaml-libnbd
Package
- Name
- ocaml-libnbd
AlmaLinux:8 / ocaml-libnbd-devel
Package
- Name
- ocaml-libnbd-devel
AlmaLinux:8 / perl-Sys-Guestfs
Package
- Name
- perl-Sys-Guestfs
AlmaLinux:8 / perl-Sys-Virt
Package
- Name
- perl-Sys-Virt
AlmaLinux:8 / perl-hivex
Package
- Name
- perl-hivex
AlmaLinux:8 / python3-hivex
Package
- Name
- python3-hivex
AlmaLinux:8 / python3-libguestfs
Package
- Name
- python3-libguestfs
AlmaLinux:8 / python3-libnbd
Package
- Name
- python3-libnbd
AlmaLinux:8 / python3-libvirt
Package
- Name
- python3-libvirt
AlmaLinux:8 / qemu-guest-agent
Package
- Name
- qemu-guest-agent
AlmaLinux:8 / qemu-img
Package
- Name
- qemu-img
AlmaLinux:8 / qemu-kvm
Package
- Name
- qemu-kvm
AlmaLinux:8 / qemu-kvm-block-curl
Package
- Name
- qemu-kvm-block-curl
AlmaLinux:8 / qemu-kvm-block-gluster
Package
- Name
- qemu-kvm-block-gluster
AlmaLinux:8 / qemu-kvm-block-iscsi
Package
- Name
- qemu-kvm-block-iscsi
AlmaLinux:8 / qemu-kvm-block-rbd
Package
- Name
- qemu-kvm-block-rbd
AlmaLinux:8 / qemu-kvm-block-ssh
Package
- Name
- qemu-kvm-block-ssh
AlmaLinux:8 / qemu-kvm-common
Package
- Name
- qemu-kvm-common
AlmaLinux:8 / qemu-kvm-core
Package
- Name
- qemu-kvm-core
AlmaLinux:8 / qemu-kvm-docs
Package
- Name
- qemu-kvm-docs
AlmaLinux:8 / qemu-kvm-hw-usbredir
Package
- Name
- qemu-kvm-hw-usbredir
AlmaLinux:8 / qemu-kvm-tests
Package
- Name
- qemu-kvm-tests
AlmaLinux:8 / qemu-kvm-ui-opengl
Package
- Name
- qemu-kvm-ui-opengl
AlmaLinux:8 / qemu-kvm-ui-spice
Package
- Name
- qemu-kvm-ui-spice
AlmaLinux:8 / ruby-hivex
Package
- Name
- ruby-hivex
AlmaLinux:8 / ruby-libguestfs
Package
- Name
- ruby-libguestfs
AlmaLinux:8 / seabios
Package
- Name
- seabios
AlmaLinux:8 / seabios-bin
Package
- Name
- seabios-bin
AlmaLinux:8 / seavgabios-bin
Package
- Name
- seavgabios-bin
AlmaLinux:8 / sgabios
Package
- Name
- sgabios
AlmaLinux:8 / sgabios-bin
Package
- Name
- sgabios-bin
AlmaLinux:8 / supermin
Package
- Name
- supermin
AlmaLinux:8 / supermin-devel
Package
- Name
- supermin-devel
AlmaLinux:8 / swtpm
Package
- Name
- swtpm
AlmaLinux:8 / swtpm-devel
Package
- Name
- swtpm-devel
AlmaLinux:8 / swtpm-libs
Package
- Name
- swtpm-libs
AlmaLinux:8 / swtpm-tools
Package
- Name
- swtpm-tools
AlmaLinux:8 / swtpm-tools-pkcs11
Package
- Name
- swtpm-tools-pkcs11
AlmaLinux:8 / virt-dib
Package
- Name
- virt-dib
AlmaLinux:8 / virt-v2v
Package
- Name
- virt-v2v
AlmaLinux:8 / virt-v2v-bash-completion
Package
- Name
- virt-v2v-bash-completion
AlmaLinux:8 / virt-v2v-man-pages-ja
Package
- Name
- virt-v2v-man-pages-ja