Most recent entries from all

ALSA-2023:0099 — Moderate: virt:rhel and virt-devel:rhel security and bug fix update

Affected: AlmaLinux:8: SLOF, AlmaLinux:8: hivex, AlmaLinux:8: hivex-devel, AlmaLinux:8: libguestfs, AlmaLinux:8: libguestfs-appliance, AlmaLinux:8: libguestfs-bash-completion, AlmaLinux:8: libguestfs-devel, AlmaLinux:8: libguestfs-gfs2, AlmaLinux:8: libguestfs-gobject, AlmaLinux:8: libguestfs-gobject-devel and 120 more

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

* QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read (CVE-2022-4144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* libvirt kills virtual machine on restart when 2M and 1G hugepages are mounted (BZ#2132176) * VMs hung on vnc_clipboard_send (BZ#2148504)

bdu:2024-02426

Withdrawn: BELL-CVE-2022-4144 — CVE-2022-4144 does not affect BellSoft software

Withdrawn by the publisher.

ESEA-2023:0047 — virt:rhel bug fix update for RHSA-2023:0099

virt:rhel bug fix update for RHSA-2023:0099

EUVD-2026-229139

fkie_cve-2022-4144

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

GHSA-rc5v-q774-439g

gsd-2022-4144

msrc_CVE-2022-4144 — An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not…

msrc_CVE-2022-4144

OESA-2022-2136 — qemu security update

Affected: openEuler:20.03-LTS-SP1: qemu, openEuler:20.03-LTS-SP3: qemu, openEuler:22.03-LTS: qemu

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

QEMU has two operating modes:

Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including one or several processors and various peripherals. It can be used to launch different Operating Systems without rebooting the PC or to debug system code.

User mode emulation. In this mode, QEMU can launch processes compiled for one CPU on another CPU. It can be used to launch the Wine Windows API emulator (https://www.winehq.org) or to ease cross-compilation and cross-debugging. Security Fix(es): An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.(CVE-2022-4144)

RHSA-2023:0099 — Red Hat Security Advisory: virt:rhel and virt-devel:rhel security and bug fix update

QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read

UBUNTU-CVE-2022-4144

Affected: Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:Pro:18.04:LTS: qemu, Ubuntu:20.04:LTS: qemu, Ubuntu:22.04:LTS: qemu

WID-SEC-W-2022-2179 — QEMU: Schwachstelle ermöglicht Denial of Service

Ein lokaler Angreifer kann eine Schwachstelle in QEMU ausnutzen, um einen Denial of Service Angriff durchzuführen.