Lucene search

K
rockyRockylinux Product ErrataRLSA-2021:4191
HistoryNov 09, 2021 - 8:35 a.m.

virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

2021-11-0908:35:34
Rockylinux Product Errata
errata.rockylinux.org
11

0.002 Low

EPSS

Percentile

61.1%

An update is available for libguestfs, libnbd, nbdkit, libguestfs-winsupport, supermin, libiscsi, hivex, libvirt, netcf, perl-Sys-Virt, seabios, qemu-kvm, sgabios, libvirt-dbus, libvirt-python.
This update affects Rocky Linux 8.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list
Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

  • QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

  • QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

  • QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

  • QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

  • QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

  • libvirt: Insecure sVirt label generation (CVE-2021-3631)

  • libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.