Related Vulnerabilities: CVE-2022-26354  

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.

Description

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.

Statement

This issue affects the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

This issue affects the versions of qemu-kvm as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Additional Information

  • Bugzilla 2063257: CVE-2022-26354 QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak
  • CWE-772: Missing Release of Resource after Effective Lifetime
  • FAQ: Frequently asked questions about CVE-2022-26354