ALSA-2021:4191

Dashboard / Vulnerabilities / ALSA-2021:4191

ALSA-2021:4191

Summary: Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Details: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859) * QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592) * QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593) * QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594) * QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595) * libvirt: Insecure sVirt label generation (CVE-2021-3631) * libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References: https://errata.almalinux.org/8/ALSA-2021-4191.html, https://vulners.com/cve/CVE-2020-15859, https://vulners.com/cve/CVE-2021-3592, https://vulners.com/cve/CVE-2021-3593, https://vulners.com/cve/CVE-2021-3594, https://vulners.com/cve/CVE-2021-3595, https://vulners.com/cve/CVE-2021-3631, https://vulners.com/cve/CVE-2021-3667