SB2021111072 - Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
Published: November 10, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Release of invalid pointer or reference (CVE-ID: CVE-2021-3592)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to invalid pointer initialization within the bootp_input() function while processing UDP packets in the SLiRP networking implementation of QEMU. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host.
2) Improper locking (CVE-ID: CVE-2021-3667)
The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.
The vulnerability exists due to double-locking error in the virStoragePoolLookupByTargetPath API in libvirt in storage/storage_driver.c. The storagePoolLookupByTargetPath() function does not properly release a locked object (virStoragePoolObj) on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions can use this vulnerability to acquire the lock and prevent other users from accessing storage pool/volume APIs. As a result a local user can perform a denial of service (DoS) attack.
3) Release of invalid pointer or reference (CVE-ID: CVE-2021-3593)
The vulnerability allows a remote attacker to gain access to sensitive information.
The
vulnerability exists due to invalid pointer initialization within the udp6_input() function while processing UDP packets in the SLiRP
networking implementation of QEMU. A malicious guest could use this vulnerability to read host memory.
4) Release of invalid pointer or reference (CVE-ID: CVE-2021-3594)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to invalid pointer initialization within the udp_input() function while processing UDP packets in the SLiRP networking implementation of QEMU. A malicious guest could use this vulnerability to read host memory.5) Use-after-free (CVE-ID: CVE-2020-15859)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in hw/net/e1000e_core.c when processing MMIO operation. A local user on guest operating system can send a specially crafted e1000e packet with the data's address set to the e1000e's MMIO address and crash the QEMU process.
6) Release of invalid pointer or reference (CVE-ID: CVE-2021-3595)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to invalid pointer initialization within the tftp_input() function while processing UDP packets in the SLiRP networking implementation of QEMU. A malicious guest could use this vulnerability to read host memory.7) Incorrect permission assignment for critical resource (CVE-ID: CVE-2021-3631)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to an error in the way SELinux MCS category pairs for VMs' dynamic labels in security/security_selinux.c. An attacker with access to the guest OS can access files labeled for another guest.
Remediation
Install update from vendor's website.