Red Hat Enterprise Linux 9 update for qemu-kvm

Published: 2022-07-06

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-26353 CVE-2022-26354
CWE-ID	CWE-416 CWE-404
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU63783

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26353

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the virtio-net device of QEMU. A privileged user can exploit this issue to crash QEMU or potentially execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM z Systems: 9

External links

http://access.redhat.com/errata/RHSA-2022:5263

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Resource Shutdown or Release

EUVDB-ID: #VU63786