PT-2021-28577

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.11.20 Description A memory leak issue exists in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.11.20,...

PT-2021-28613

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.36 Description A memory leak issue exists in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.10.36,...

PT-2021-24821

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.37 Description: The issue concerns the handling of queued packets when closing a socket in the vsock/virtio component. It was introduced in version v5.2 and fixed in version v5.10.37. The actual impact and...

PT-2021-24544

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.12.3 Description: A memory leak issue exists in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.12.3,...

PT-2021-24619

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.36 Description A memory leak issue exists in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.10.36,...

PT-2021-24583

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.11.20 Description A memory leak issue exists in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.11.20,...

PT-2021-24711

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.2 through v5.12.3 Description The issue concerns the handling of queued packets when closing a socket in the vsock/virtio component. It was introduced in version v5.2 and fixed in version v5.12.4. The actual impact and...

PT-2021-28538

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.4 through v5.12.3 Description A memory leak issue was discovered in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.4 throu...

PT-2021-24649

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.118 Description A memory leak issue was discovered in the virtio fs probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

virtio-win bug fix and enhancement update

An update is available for virtio-win. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

CVE-2021-3544

Several memory leaks were found in the virtio vhost-user GPU device vhost-user-gpu of QEMU. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory i.e., free after effective lifetime...

CVE-2021-3545

An information disclosure vulnerability was found in the virtio vhost-user GPU device vhost-user-gpu of QEMU. The flaw exists in virglcmdgetcapsetinfo in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memo...

PT-2021-5459

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 6.0 Description An information disclosure issue exists in the virtio vhost-user GPU device of QEMU, specifically in the virgl cmd get capset info function in contrib/vhost-user-gpu/virgl.c. This issue could...

PT-2021-5460

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 6.0 Description The issue is related to several memory leaks found in the virtio vhost-user GPU device of QEMU. These leaks exist in the contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl...

PT-2021-5462

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 6.0 Description The issue is related to an out-of-bounds write vulnerability in the virtio vhost-user GPU device of QEMU. This vulnerability occurs while processing the VIRTIO GPU CMD GET CAPSET command from t...

PT-2021-28239

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

qemu:qemu-fuzz-i386-target-generic-fuzz-virtio-net-pci-slirp: Heap-use-after-free in iov_from_buf_full

Detailed Report: https://oss-fuzz.com/testcase?key=5164103938211840 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-virtio-net-pci-slirp Job Type: libfuzzerasanqemu Platform Id: linux Crash Type: Heap-use-after-free WRITE 2 Crash Address: 0x62500011e00a Cra...

qemu:qemu-fuzz-i386-target-generic-fuzz-virtio-9p-synth: Crash in synth_name_to_path

Detailed Report: https://oss-fuzz.com/testcase?key=5706037500968960 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-virtio-9p-synth Job Type: libfuzzerubsanqemu Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x296c6c756e28 Crash State:...

PT-2021-8268 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the Linux kernel when closing a socket. Specifically, the vsock/virtio component fails to free queued packets, leading to a memory leak. This w...

dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity chec...