Summary
[15:4.2.1-28.el7]
- virtio-crypto: verify src&dst buffer length for sym request (Zhenwei Pi) [Orabug: 35724113] {CVE-2023-3180}
- hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35724112] {CVE-2023-0330}
- kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35719844]
- KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35719844]
- accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35719844]
- KVM: Use a big lock to replace per-kml slots_lock (Peter Xu) [Orabug: 35719844]
- pcie: don't set link state active if the slot is empty (Laurent Vivier) [Orabug: 35707933]
- vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug: 35662850] {CVE-2023-3301}
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ivshmem-tools | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-block-gluster | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-block-iscsi | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-block-rbd | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-common | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-img | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-kvm | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-kvm-core | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-system-aarch64 | 15:4.2.1-28.el7 |
| Oracle Linux · 7 | qemu-system-aarch64-core | 15:4.2.1-28.el7 |
Vulnerabilities 3
-
Medium 6.0
Heap buffer overflow in virtio_crypto_sym_op_helper()
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buf…
-
Medium 5.6
Triggerable assertion due to race condition in hot-unplug
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a de…
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.