—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA256<\/p>\n
====================================================================
\nRed Hat Security Advisory<\/p>\n
Synopsis: Important: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.10] Async #1
\nAdvisory ID: RHSA-2022:0841-01
\nProduct: Red Hat Virtualization
\nAdvisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2022:0841
\nIssue date: 2022-03-14
\nCVE Names: CVE-2021-0920 CVE-2021-4154 CVE-2022-0330
\nCVE-2022-0435 CVE-2022-0847 CVE-2022-22942
\nCVE-2022-24407
\n====================================================================
\n1. Summary:<\/p>\n
An update for redhat-release-virtualization-host and
\nredhat-virtualization-host is now available for Red Hat Virtualization 4
\nfor Red Hat Enterprise Linux 8.<\/p>\n
Red Hat Product Security has rated this update as having a security impact
\nof Important. A Common Vulnerability Scoring System (CVSS) base score,
\nwhich gives a detailed severity rating, is available for each vulnerability
\nfrom the CVE link(s) in the References section.<\/p>\n
2. Relevant releases\/architectures:<\/p>\n
RHEL 8-based RHEV-H for RHEV 4 (build requirements) – noarch, x86_64
\nRed Hat Virtualization 4 Hypervisor for RHEL 8 – x86_64<\/p>\n
3. Description:<\/p>\n
The redhat-virtualization-host packages provide the Red Hat Virtualization
\nHost. These packages include redhat-release-virtualization-host,
\novirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are
\ninstalled using a special build of Red Hat Enterprise Linux with only the
\npackages required to host virtual machines. RHVH features a Cockpit user
\ninterface for monitoring the host’s resources and performing administrative
\ntasks.<\/p>\n
Security Fix(es):<\/p>\n
* kernel: improper initialization of the “flags” member of the new
\npipe_buffer (CVE-2022-0847)<\/p>\n
* kernel: Use After Free in unix_gc() which could result in a local
\nprivilege escalation (CVE-2021-0920)<\/p>\n
* kernel: local privilege escalation by exploiting the fsconfig syscall
\nparameter leads to container breakout (CVE-2021-4154)<\/p>\n
* kernel: possible privileges escalation due to missing TLB flush
\n(CVE-2022-0330)<\/p>\n
* kernel: remote stack overflow via kernel panic on systems using TIPC may
\nlead to DoS (CVE-2022-0435)<\/p>\n
* kernel: failing usercopy allows for use-after-free exploitation
\n(CVE-2022-22942)<\/p>\n
* cyrus-sasl: failure to properly escape SQL input allows an attacker to
\nexecute arbitrary SQL commands (CVE-2022-24407)<\/p>\n
For more details about the security issue(s), including the impact, a CVSS
\nscore, acknowledgments, and other related information, refer to the CVE
\npage(s) listed in the References section.<\/p>\n
4. Solution:<\/p>\n
For details on how to apply this update, which includes the changes
\ndescribed in this advisory, refer to:<\/p>\n
https:\/\/access.redhat.com\/articles\/2974891<\/p>\n
5. Bugs fixed (https:\/\/bugzilla.redhat.com\/):<\/p>\n
2031930 – CVE-2021-0920 kernel: Use After Free in unix_gc() which could result in a local privilege escalation
\n2034514 – CVE-2021-4154 kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout
\n2042404 – CVE-2022-0330 kernel: possible privileges escalation due to missing TLB flush
\n2044809 – CVE-2022-22942 kernel: failing usercopy allows for use-after-free exploitation
\n2048738 – CVE-2022-0435 kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS
\n2055326 – CVE-2022-24407 cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands
\n2060795 – CVE-2022-0847 kernel: improper initialization of the “flags” member of the new pipe_buffer<\/p>\n
6. Package List:<\/p>\n
Red Hat Virtualization 4 Hypervisor for RHEL 8:<\/p>\n
Source:
\nredhat-virtualization-host-4.4.10-202203101736_8.5.src.rpm<\/p>\n
x86_64:
\nredhat-virtualization-host-image-update-4.4.10-202203101736_8.5.x86_64.rpm<\/p>\n
RHEL 8-based RHEV-H for RHEV 4 (build requirements):<\/p>\n
Source:
\nredhat-release-virtualization-host-4.4.10-2.el8ev.src.rpm<\/p>\n
noarch:
\nredhat-virtualization-host-image-update-placeholder-4.4.10-2.el8ev.noarch.rpm<\/p>\n
x86_64:
\nredhat-release-virtualization-host-4.4.10-2.el8ev.x86_64.rpm
\nredhat-release-virtualization-host-content-4.4.10-2.el8ev.x86_64.rpm<\/p>\n
These packages are GPG signed by Red Hat for security. Our key and
\ndetails on how to verify the signature are available from
\nhttps:\/\/access.redhat.com\/security\/team\/key\/<\/p>\n
7. References:<\/p>\n
https:\/\/access.redhat.com\/security\/cve\/CVE-2021-0920
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2021-4154
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-0330
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-0435
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-0847
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-22942
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-24407
\nhttps:\/\/access.redhat.com\/security\/updates\/classification\/#important
\nhttps:\/\/access.redhat.com\/security\/vulnerabilities\/RHSB-2022-002<\/p>\n
8. Contact:<\/p>\n
The Red Hat security contact is <secalert@redhat.com>. More contact
\ndetails at https:\/\/access.redhat.com\/security\/team\/contact\/<\/p>\n
Copyright 2022 Red Hat, Inc.
\n—–BEGIN PGP SIGNATURE—–
\nVersion: GnuPG v1<\/p>\n
iQIVAwUBYi9a3tzjgjWX9erEAQgLLQ\/+IAkXeu1C8POOtQTWriDPquGCvWziTjML
\nrV1GT9Wml6WjFPTG7X4KxKTz8D\/adSLmbTbtq6tpVvQZK8LCCLhTtmWTAr1LDHqs
\ntyZSd2gyX33YgKubGq3K0VYTpYlXuw6tHkIzsTDeejrGDs2q\/N2+yXgDMOCqA0A7
\nwJjPrhn7bZZ+uz3mKV8x632d2CBuPaPakFrriEKs2geJy0S\/3Htm5dtESUNSjRqi
\n74USXZ65YRDaZwbY1TtUrJ09FdvOfH4Xdk5TY2PuBjKR0eI0BSb5AiyvmzBWaJRm
\niGZVVPqfftpKKTMUMQ3XPIxP1tVhhlVpadw8AiBrfk5t4wCcMS5DcKGtud6Z4EGZ
\ngVZdb8xkgpKiFgF29\/jZUX7xAGdXxVXcaSl8nz7hbNUWXPhZvbIM2rQFxZAD0a86
\nnM2fGGgyzNVrgpNeop2irvidrkDRU8yLbtoVYPRkAdPmXuRSKgCmEk1tS6VZ+eXH
\nNgDRVsjCBawTv71dMhm60qNS7SxVRU1KWnCXanmsQBhMJC2xmKrAuBd\/vd4b5Ybt
\nhVp2se8Ao3CCUmhquBaJr+RKyIG+WE3+SwR0ceN3+rE0YRvITgyqFfG3tzvO\/NQT
\nw2Yvh9VCaxCHar44YE3JJJSbQ4t\/0iVGS9j4XE079HnZhEcB6YIn1Yl58BeTahHT
\n3AqkD91dcqc=Ka4y
\n—–END PGP SIGNATURE—–
\n—
\nRHSA-announce mailing list
\nRHSA-announce@redhat.com
\nhttps:\/\/listman.redhat.com\/mailman\/listinfo\/rhsa-announce<\/p>\n","protected":false},"excerpt":{"rendered":"
—–BEGIN PGP SIGNED MESSAGE—– Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.10] Async #1 Advisory ID: RHSA-2022:0841-01 Product: Red Hat Virtualization Advisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2022:0841 Issue date: 2022-03-14 CVE Names: CVE-2021-0920 CVE-2021-4154 CVE-2022-0330 CVE-2022-0435 CVE-2022-0847 CVE-2022-22942 CVE-2022-24407 ==================================================================== 1. Summary: An update for redhat-release-virtualization-host and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-21712","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=21712"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21712\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=21712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=21712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=21712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}