Описание
ELSA-2022-9123: qemu security update (IMPORTANT)
[15:4.2.1-15.el7]
- Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda) [Orabug: 33719302] [Orabug: 33754145] {CVE-2021-3947} {CVE-2021-4158}
- hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daude) [Orabug: 32439466] {CVE-2021-20196}
- hw/block/fdc: Extract blk_create_empty_drive() (Philippe Mathieu-Daude) [Orabug: 32439466] {CVE-2021-20196}
- net: vmxnet3: validate configuration values during activate (CVE-2021-20203) (Prasad J Pandit) [Orabug: 32559476] {CVE-2021-20203}
- lan9118: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
- pcnet: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
- rtl8139: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
- tx_pkt: switch to use qemu_receive_packet_iov() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- sungem: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- dp8393x: switch to use qemu_receive_packet() for loopback packet (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- e1000: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- net: introduce qemu_receive_packet() (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- target/i386: Populate x86_ext_save_areas offsets using cpuid where possible (David Edmondson)
- target/i386: Observe XSAVE state area offsets (David Edmondson)
- target/i386: Make x86_ext_save_areas visible outside cpu.c (David Edmondson)
- target/i386: Pass buffer and length to XSAVE helper (David Edmondson)
- target/i386: Clarify the padding requirements of X86XSaveArea (David Edmondson)
- target/i386: Consolidate the X86XSaveArea offset checks (David Edmondson)
- target/i386: Declare constants for XSAVE offsets (David Edmondson)
Обновленные пакеты
Oracle Linux 7
Oracle Linux aarch64
ivshmem-tools
4.2.1-15.el7
qemu
4.2.1-15.el7
qemu-block-gluster
4.2.1-15.el7
qemu-block-iscsi
4.2.1-15.el7
qemu-block-rbd
4.2.1-15.el7
qemu-common
4.2.1-15.el7
qemu-img
4.2.1-15.el7
qemu-kvm
4.2.1-15.el7
qemu-kvm-core
4.2.1-15.el7
qemu-system-aarch64
4.2.1-15.el7
qemu-system-aarch64-core
4.2.1-15.el7
Oracle Linux x86_64
qemu
4.2.1-15.el7
qemu-block-gluster
4.2.1-15.el7
qemu-block-iscsi
4.2.1-15.el7
qemu-block-rbd
4.2.1-15.el7
qemu-common
4.2.1-15.el7
qemu-img
4.2.1-15.el7
qemu-kvm
4.2.1-15.el7
qemu-kvm-core
4.2.1-15.el7
qemu-system-x86
4.2.1-15.el7
qemu-system-x86-core
4.2.1-15.el7
Ссылки на источники
Связанные уязвимости
ELSA-2022-9172: virt:kvm_utils security update (IMPORTANT)
ALT-PU-2022-1412: package `qemu` update to version 6.1.1-alt1
ALT-PU-2021-3585: package `qemu` update to version 6.2.0-alt1
ALT-PU-2022-7880: package `pve-qemu` update to version 6.1.1-alt1
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.