Lucene search

K
redhatRedHatRHSA-2021:1762
HistoryMay 18, 2021 - 6:02 a.m.

(RHSA-2021:1762) Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

2021-05-1806:02:26
access.redhat.com
54

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.1%

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

  • libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-25637)

  • QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c (CVE-2020-27821)

  • QEMU: ide: atapi: OOB access while processing read commands (CVE-2020-29443)

  • QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure (CVE-2020-11947)

  • QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092)

  • QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c (CVE-2020-25707)

  • QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c (CVE-2020-25723)

  • QEMU: e1000e: infinite loop scenario in case of null packet descriptor (CVE-2020-28916)

  • QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets (CVE-2020-29129, CVE-2020-29130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyx86_64qemu-guest-agent< 4.2.0-48.module+el8.4.0+10368+630e803bqemu-guest-agent-4.2.0-48.module+el8.4.0+10368+630e803b.x86_64.rpm
RedHatanyaarch64libvirt-dbus-debuginfo< 1.3.0-2.module+el8.3.0+6423+e4cb6418libvirt-dbus-debuginfo-1.3.0-2.module+el8.3.0+6423+e4cb6418.aarch64.rpm
RedHatanyppc64lelibvirt-daemon-driver-qemu-debuginfo< 6.0.0-35.module+el8.4.0+10230+7a9b21e4libvirt-daemon-driver-qemu-debuginfo-6.0.0-35.module+el8.4.0+10230+7a9b21e4.ppc64le.rpm
RedHatanyppc64lelibvirt-daemon-driver-storage-scsi< 6.0.0-35.module+el8.4.0+10230+7a9b21e4libvirt-daemon-driver-storage-scsi-6.0.0-35.module+el8.4.0+10230+7a9b21e4.ppc64le.rpm
RedHatanyppc64lelibguestfs-tools-c< 1.40.2-27.module+el8.4.0+9282+0bdec052libguestfs-tools-c-1.40.2-27.module+el8.4.0+9282+0bdec052.ppc64le.rpm
RedHatanyppc64lelibvirt-libs-debuginfo< 6.0.0-35.module+el8.4.0+10230+7a9b21e4libvirt-libs-debuginfo-6.0.0-35.module+el8.4.0+10230+7a9b21e4.ppc64le.rpm
RedHatanyi686libiscsi-devel< 1.18.0-8.module+el8.1.0+4066+0f1aadablibiscsi-devel-1.18.0-8.module+el8.1.0+4066+0f1aadab.i686.rpm
RedHatanyi686libvirt-dbus-debugsource< 1.3.0-2.module+el8.3.0+6423+e4cb6418libvirt-dbus-debugsource-1.3.0-2.module+el8.3.0+6423+e4cb6418.i686.rpm
RedHatanys390xsupermin< 5.1.19-10.module+el8.3.0+6423+e4cb6418supermin-5.1.19-10.module+el8.3.0+6423+e4cb6418.s390x.rpm
RedHatanyi686libvirt-daemon-driver-storage-core< 6.0.0-35.module+el8.4.0+10230+7a9b21e4libvirt-daemon-driver-storage-core-6.0.0-35.module+el8.4.0+10230+7a9b21e4.i686.rpm
Rows per page:
1-10 of 8191

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.1%