Most recent entries from all

ALSA-2021:3061 — Moderate: virt:rhel and virt-devel:rhel security and bug fix update

Affected: AlmaLinux:8: libguestfs-winsupport, AlmaLinux:8: libiscsi, AlmaLinux:8: libiscsi-devel, AlmaLinux:8: libiscsi-utils, AlmaLinux:8: libnbd, AlmaLinux:8: libnbd-devel, AlmaLinux:8: libvirt-dbus, AlmaLinux:8: nbdfuse, AlmaLinux:8: nbdkit, AlmaLinux:8: nbdkit-bash-completion and 25 more

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

* QEMU: msix: OOB access during mmio operations may lead to DoS (CVE-2020-13754)

* hivex: Buffer overflow when provided invalid node key length (CVE-2021-3504)

* QEMU: net: an assert failure via eth_get_gso_type (CVE-2020-27617)

* QEMU: net: infinite loop in loopback mode may lead to stack overflow (CVE-2021-3416)

* qemu: out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* cannot restart default network and firewalld: iptables: No chain/target/match by that name. (BZ#1958301)

* RHEL8.4 Nightly[0322] - KVM guest fails to find zipl boot menu index (qemu-kvm) (BZ#1975679)

bdu:2022-05839

Withdrawn: BELL-CVE-2021-3416 — CVE-2021-3416 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-485 — De multiples vulnérabilités ont été découvertes dans Citrix Hypervisor. Elles permettent à un attaquant de provoquer un…

certfr-2021-avi-485

cnvd-2021-39778

EUVD-2026-20808

fkie_cve-2021-3416

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

GHSA-g3hx-jv57-3ffr

gsd-2021-3416

msrc_CVE-2021-3416 — A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and inc…

msrc_CVE-2021-3416

OESA-2021-1191 — qemu security update

Affected: openEuler:20.03-LTS-SP1: qemu

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es): A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.(CVE-2021-3416) The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.(CVE-2021-3409) A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.(CVE-2021-3392) QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE…

RHSA-2021:3061 — Red Hat Security Advisory: virt:rhel and virt-devel:rhel security and bug fix update

QEMU: msix: OOB access during mmio operations may lead to DoS QEMU: net: an assert failure via eth_get_gso_type QEMU: net: Infinite loop in loopback mode may lead to stack overflow hivex: Buffer overflow when provided invalid node key length qemu: out-of-bound heap buffer access via an interrupt ID field

SUSE-SU-2021:1305-1 — Security update for qemu

Security update for qemu

UBUNTU-CVE-2021-3416

Affected: Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:18.04:LTS: qemu, Ubuntu:20.04:LTS: qemu

WID-SEC-W-2022-1098 — QEMU: Schwachstelle ermöglicht Denial of Service

Ein lokaler authentifiziert Angreifer kann eine Schwachstelle in QEMU ausnutzen, um einen Denial of Service Angriff durchzuführen.