Most recent entries from all

ALSA-2022:8003 — Low: libvirt security, bug fix, and enhancement update

Affected: AlmaLinux:9: libvirt, AlmaLinux:9: libvirt-client, AlmaLinux:9: libvirt-daemon, AlmaLinux:9: libvirt-daemon-config-network, AlmaLinux:9: libvirt-daemon-config-nwfilter, AlmaLinux:9: libvirt-daemon-driver-interface, AlmaLinux:9: libvirt-daemon-driver-network, AlmaLinux:9: libvirt-daemon-driver-nodedev, AlmaLinux:9: libvirt-daemon-driver-nwfilter, AlmaLinux:9: libvirt-daemon-driver-qemu and 15 more

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313)

Security Fix(es):

* libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-05846

ESSA-2022:0193 — security update for

security update for

EUVD-2026-11328

fkie_cve-2022-0897

A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

GHSA-4r2g-j5rc-7wqf

A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the `driver->nwfilters` mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the `driver->nwfilters` object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt’s API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

gsd-2022-0897

OESA-2022-1722 — libvirt security update

Affected: openEuler:20.03-LTS-SP1: libvirt, openEuler:20.03-LTS-SP3: libvirt, openEuler:22.03-LTS: libvirt

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es): A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the `driver->nwfilters` mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the `driver->nwfilters` object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt’s API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).(CVE-2022-0897)

RHSA-2022:7472 — Red Hat Security Advisory: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

QEMU: fdc: heap buffer overflow in DMA read data transfers libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service libguestfs: Buffer overflow in get_keys leads to DoS swtpm: Unchecked header size indicator against expected size

SUSE-SU-2022:1540-1 — Security update for libvirt

Security update for libvirt

UBUNTU-CVE-2022-0897

Affected: Ubuntu:18.04:LTS: libvirt, Ubuntu:20.04:LTS: libvirt, Ubuntu:22.04:LTS: libvirt

WID-SEC-W-2022-0118 — libvirt: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in libvirt ausnutzen, um einen Denial of Service Angriff durchzuführen.