Summary
[15:4.2.1-11.el7]
- pvrdma: Fix the ring init error flow (CVE-2021-3608) (Marcel Apfelbaum) [Orabug: 33120142] {CVE-2021-3608}
- pvrdma: Ensure correct input on ring init (CVE-2021-3607) (Marcel Apfelbaum) [Orabug: 33120146] {CVE-2021-3607}
- hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) (Marcel Apfelbaum) [Orabug: 33120084] {CVE-2021-3582}
- vhost-user-gpu: reorder free calls. (Gerd Hoffmann) [Orabug: 32950701] {CVE-2021-3544}
- vhost-user-gpu: abstract vg_cleanup_mapping_iov (Li Qiang) [Orabug: 32950716] {CVE-2021-3546}
- vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) (Li Qiang) [Orabug: 32950716] {CVE-2021-3546}
- vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
- vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
- vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
- vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544) (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
- vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544) (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
- vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545) (Li Qiang) [Orabug: 32950708] {CVE-2021-3545}
- usb: limit combined packets to 1 MiB (CVE-2021-3527) (Gerd Hoffmann) [Orabug: 32842778] {CVE-2021-3527}
- usb/redir: avoid dynamic stack allocation (CVE-2021-3527) (Gerd Hoffmann) [Orabug: 32842778] {CVE-2021-3527}
- mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392) (Michael Tokarev) [Orabug: 32470463] {CVE-2021-3392}
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ivshmem-tools | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-block-gluster | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-block-iscsi | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-block-rbd | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-common | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-img | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-kvm | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-kvm-core | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-system-aarch64 | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-system-aarch64-core | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-system-x86 | 15:4.2.1-11.el7 |
| Oracle Linux · 7 | qemu-system-x86-core | 15:4.2.1-11.el7 |
Vulnerabilities 8
-
Unscored —
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests …
-
Unscored —
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large …
-
Unscored —
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and incl…
-
Unscored —
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versi…
-
Unscored —
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVR…
-
Unscored —
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue o…