Описание
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
Отчет
A user who installs or updates to Red Hat Enterprise Linux 9.1 would be vulnerable to the CVE-2021-3750, even if it was declared fixed in the following advisory: https://access.redhat.com/errata/RHSA-2022:7967 The advisory provided updates for qemu-kvm package, but did not actually include fixes for CVE-2021-3750. The CVE-2023-2680 was assigned to this Red Hat specific issue and it is not applicable to any upstream QEMU version or QEMU packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages. For more details about the original security flaw CVE-2021-3750, refer to the CVE page: https://access.redhat.com/security/cve/CVE-2021-3750.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | qemu-kvm | Not affected | ||
| Red Hat Enterprise Linux 7 | qemu-kvm | Not affected | ||
| Red Hat Enterprise Linux 7 | qemu-kvm-ma | Not affected | ||
| Red Hat Enterprise Linux 8 | virt:rhel/qemu-kvm | Not affected | ||
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:av/qemu-kvm | Not affected | ||
| Red Hat OpenStack Platform 13 (Queens) | qemu-kvm-rhev | Not affected | ||
| Red Hat Enterprise Linux 9 | qemu-kvm | Fixed | RHSA-2023:6368 | 07.11.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
This CVE exists because of an incomplete fix for CVE-2021-3750. More s ...
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
ELSA-2023-6368: qemu-kvm security, bug fix, and enhancement update (MODERATE)
EPSS
7.5 High
CVSS3