RLSA-2022:1759 — Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Summary

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0), libvirt (8.0.0), libvirt-python (8.0.0), perl-Sys-Virt (8.0.0), seabios (1.15.0), libtpms (0.9.1). (BZ#1997410, BZ#2012802, BZ#2012806, BZ#2012813, BZ#2018392, BZ#2027716, BZ#2029355)

Security Fix(es):

* QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748)

* ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records (CVE-2021-33285)

* ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)

* ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes (CVE-2021-33287)

* ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)

* ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)

* ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections (CVE-2021-35267)

* ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode (CVE-2021-35268)

* ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT (CVE-2021-35269)

* ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251)

* ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252)

* ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253)

* ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() (CVE-2021-39254)

* ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute (CVE-2021-39255)

* ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256)

* ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257)

* ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258)

* ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length (CVE-2021-39259)

* ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260)

* ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261)

* ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)

* ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute (CVE-2021-39263)

* libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485)

* hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622)

* nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716)

* libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975)

* QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c (CVE-2021-4145)

* QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

* QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Fixed packages 30

Release	Package	Fixed in
Rocky Linux · 8	hivex	0:1.3.18-23.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	hivex	0:1.3.18-23.module+el8.6.0+847+b490afdd
Rocky Linux · 8	libguestfs	1:1.44.0-5.module+el8.6.0+1052+ff61d164.rocky
Rocky Linux · 8	libguestfs-winsupport	0:8.6-1.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	libguestfs-winsupport	0:8.6-1.module+el8.6.0+847+b490afdd
Rocky Linux · 8	libiscsi	0:1.18.0-8.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	libiscsi	0:1.18.0-8.module+el8.4.0+534+4680a14e
Rocky Linux · 8	libiscsi	0:1.18.0-8.module+el8.6.0+847+b490afdd
Rocky Linux · 8	libnbd	0:1.6.0-5.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	libnbd	0:1.6.0-5.module+el8.6.0+847+b490afdd
Rocky Linux · 8	libtpms	0:0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+1052+ff61d164
Rocky Linux · 8	libvirt	0:8.0.0-5.module+el8.6.0+847+b490afdd
Rocky Linux · 8	libvirt-dbus	0:1.3.0-2.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	libvirt-dbus	0:1.3.0-2.module+el8.4.0+534+4680a14e
Rocky Linux · 8	libvirt-dbus	0:1.3.0-2.module+el8.6.0+847+b490afdd
Rocky Linux · 8	libvirt-python	0:8.0.0-1.module+el8.6.0+847+b490afdd
Rocky Linux · 8	nbdkit	0:1.24.0-4.module+el8.6.0+847+b490afdd
Rocky Linux · 8	netcf	0:0.2.8-12.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	netcf	0:0.2.8-12.module+el8.4.0+534+4680a14e
Rocky Linux · 8	netcf	0:0.2.8-12.module+el8.6.0+847+b490afdd
Rocky Linux · 8	perl-Sys-Virt	0:8.0.0-1.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	perl-Sys-Virt	0:8.0.0-1.module+el8.6.0+847+b490afdd
Rocky Linux · 8	qemu-kvm	5:6.2.0-11.module+el8.6.0+1000+18e3b59f.5
Rocky Linux · 8	seabios	0:1.15.0-2.module+el8.6.0+1052+ff61d164
Rocky Linux · 8	sgabios	1:0.20170427git-3.module+el8.7.0+1084+97b81f61
Rocky Linux · 8	sgabios	1:0.20170427git-3.module+el8.4.0+534+4680a14e
Rocky Linux · 8	sgabios	1:0.20170427git-3.module+el8.6.0+847+b490afdd
Rocky Linux · 8	supermin	0:5.2.1-1.module+el8.6.0+1052+ff61d164
Rocky Linux · 8	swtpm	0:0.7.0-1.20211109gitb79fd91.module+el8.6.0+847+b490afdd
Rocky Linux · 8	virt-v2v	1:1.42.0-18.module+el8.6.0+847+b490afdd

Vulnerabilities 29

Medium 6.7

CVE-2021-33285

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-33287

In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a h…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-35268

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a …

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39251

A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39252

A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39253

A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39254

A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function …

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39255

A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39256

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39258

A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39259

A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_looku…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39260

A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39261

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39262

A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Medium 6.7

CVE-2021-39263

A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-20196

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/…

qemu xen qemu qemu Virtualization Debian Ubuntu Alpine

May 26, 2021
Unscored —

CVE-2021-33286

In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer ove…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-33289

In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overfl…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-35266

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffe…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-35267

NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror al…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-35269

NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_s…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-3622

A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive…

hivex hivex hivex Debian Ubuntu Azure Linux

Dec 23, 2021
Unscored —

CVE-2021-3716

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM…

nbdkit nbdkit Debian Ubuntu

Mar 2, 2022
Unscored —

CVE-2021-3748

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address…

qemu qemu qemu Virtualization Debian Ubuntu Azure Linux

Mar 23, 2022
Unscored —

CVE-2021-39257

A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs…

ntfs-3g ntfs-3g ntfs-3g Debian Ubuntu Azure Linux

Sep 7, 2021
Unscored —

CVE-2021-3975 Public exploit

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is call…

libvirt libvirt Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-4145

A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` poi…

qemu qemu Virtualization Debian Azure Linux

Jan 25, 2022
Unscored —

CVE-2021-4158

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…

qemu qemu qemu qemu Virtualization Debian Ubuntu Azure Linux Alpine

Aug 24, 2022
Unscored —

CVE-2022-0485

A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd …

libnbd libnbd libnbd Debian Ubuntu Alpine

Aug 29, 2022

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=1677608
report
https://bugzilla.redhat.com/show_bug.cgi?id=1510237
report
https://bugzilla.redhat.com/show_bug.cgi?id=1689202
report
https://bugzilla.redhat.com/show_bug.cgi?id=1738392
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743098
report
https://bugzilla.redhat.com/show_bug.cgi?id=1806857
report
https://bugzilla.redhat.com/show_bug.cgi?id=1810863
report
https://bugzilla.redhat.com/show_bug.cgi?id=1836094
report
https://bugzilla.redhat.com/show_bug.cgi?id=1845468
report
https://bugzilla.redhat.com/show_bug.cgi?id=1852762
report
https://bugzilla.redhat.com/show_bug.cgi?id=1867087
report
https://bugzilla.redhat.com/show_bug.cgi?id=1919210
report
https://bugzilla.redhat.com/show_bug.cgi?id=1924972
report
https://bugzilla.redhat.com/show_bug.cgi?id=1926508
report
https://bugzilla.redhat.com/show_bug.cgi?id=1942275
report
https://bugzilla.redhat.com/show_bug.cgi?id=1943203
report
https://bugzilla.redhat.com/show_bug.cgi?id=1953389
report
https://bugzilla.redhat.com/show_bug.cgi?id=1965140
report
https://bugzilla.redhat.com/show_bug.cgi?id=1965589
report
https://bugzilla.redhat.com/show_bug.cgi?id=1965638
report
https://bugzilla.redhat.com/show_bug.cgi?id=1972515
report
https://bugzilla.redhat.com/show_bug.cgi?id=1975489
report
https://bugzilla.redhat.com/show_bug.cgi?id=1975840
report
https://bugzilla.redhat.com/show_bug.cgi?id=1978574
report
https://bugzilla.redhat.com/show_bug.cgi?id=1981782
report
https://bugzilla.redhat.com/show_bug.cgi?id=1982993
report
https://bugzilla.redhat.com/show_bug.cgi?id=1983684
report
https://bugzilla.redhat.com/show_bug.cgi?id=1984721
report
https://bugzilla.redhat.com/show_bug.cgi?id=1985451
report
https://bugzilla.redhat.com/show_bug.cgi?id=1988104
report
https://bugzilla.redhat.com/show_bug.cgi?id=1988986
report
https://bugzilla.redhat.com/show_bug.cgi?id=1989338
report
https://bugzilla.redhat.com/show_bug.cgi?id=1989520
report
https://bugzilla.redhat.com/show_bug.cgi?id=1990135
report
https://bugzilla.redhat.com/show_bug.cgi?id=1994695
report
https://bugzilla.redhat.com/show_bug.cgi?id=1995865
report
https://bugzilla.redhat.com/show_bug.cgi?id=1996530
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997410
report
https://bugzilla.redhat.com/show_bug.cgi?id=1998514

Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Summary

Fixed packages 30

Vulnerabilities 29

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute…

In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a h…

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a …

A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.

A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.

A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.

A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function …

A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in…

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.

A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.

A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_looku…

A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.

A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.

A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute…

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/…

In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer ove…

In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overfl…

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffe…

NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror al…

NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_s…

A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive…

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM…

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address…

A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs…

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is call…

A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` poi…

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…

A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd …

References