Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Topic

An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-46790)
• QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165)
• ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value (CVE-2022-30784)
• ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate (CVE-2022-30786)
• ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc (CVE-2022-30788)
• ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array (CVE-2022-30789)
• tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux Server - AUS 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64

Fixes

• BZ - 2018885 - [virtiofs] virtiofsd debug log's timestamp is NULL
• BZ - 2074205 - while live-migrating many instances concurrently, libvirt sometimes return internal error: migration was active, but no RAM info was set
• BZ - 2090990 - qemu crash with error scsi_req_unref(SCSIRequest *): Assertion `req->refcount > 0' failed or scsi_dma_complete(void *, int): Assertion `r->req.aiocb != NULL' failed [8.7.0]
• BZ - 2093314 - CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value
• BZ - 2093326 - CVE-2022-30786 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate
• BZ - 2093340 - CVE-2022-30788 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc
• BZ - 2093348 - CVE-2022-30789 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array
• BZ - 2093358 - CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck
• BZ - 2117149 - Can't run when memory backing with hugepages and backend type memfd
• BZ - 2123196 - libvirt kills virtual machine on restart when 2M and 1G hugepages are mounted
• BZ - 2124757 - RHEL8: skey test in kvm_unit_test got failed
• BZ - 2125119 - Mirror job with "copy-mode":"write-blocking" that used for storage migration can't converge under heavy I/O
• BZ - 2128225 - [s390x] [RHEL8][s390x-ccw bios] lacking document about parameter loadparm in qemu
• BZ - 2129739 - CVE-2022-3165 QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion
• BZ - 2132609 - qemu-kvm: backport some aarch64 fixes
• BZ - 2136591 - libvirt-guests needs virsh
• BZ - 2137740 - Multifd migration fails under a weak network/socket ordering race
• BZ - 2143907 - nbdkit: error: /home/vddk8.0.0/lib64/libvixDiskLib.so.7: cannot open shared object file: No such file or directory
• BZ - 2147617 - qemu-img finishes successfully while having errors in commit or bitmaps operations
• BZ - 2148578 - Hit message: couldn't write '1' to 'vm/unprivileged_userfaultfd in the package installation terminal
• BZ - 2149420 - CVE-2023-1018 tpm2: TCG TPM2.0 implementations vulnerable to memory corruption
• BZ - 2149752 - qemuAgentGetDisks cannot parse response from a guest agent running in Windows VM
• BZ - 2152188 - VMs requiring vTPM fails to create
• BZ - 2153688 - Bad permissions for files shipped by libvirt-client
• BZ - 2161188 - SVM: non atomic memslot updates cause boot failure with seabios and cpu-pm=on
• BZ - 2165011 - [s390x] add optional device address of channel device to css device
• BZ - 2165428 - [memory leak]libvirt hit memory leak when start service
• BZ - 2166573 - Valgrind catched memory leaking in libvirt
• BZ - 2168116 - [MT2910] XML error: Invalid value for attribute 'speed' in element 'link': '(null)'.
• BZ - 2168187 - [s390x] qemu-kvm coredumps when SE crashes
• BZ - 2172578 - Networking receive/transmit_bytes metrics values are swapped
• BZ - 2184183 - virt-v2v conversions fail with "Multiple same specifications for /.*"

CVEs

• CVE-2021-46790
• CVE-2022-3165
• CVE-2022-30784
• CVE-2022-30786
• CVE-2022-30788
• CVE-2022-30789
• CVE-2023-1018

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index