Red Hat Security AdvisoryRHSA-2021:0347
qemu-kvm security and bug fix update
Released 2021-02-02 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) qemu-img-10:1.5.3-175.el7_9.3, qemu-kvm-10:1.5.3-175.el7_9.3, qemu-kvm-common-10:1.5.3-175.el7_9.3 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) qemu-img-10:1.5.3-175.el7_9.3, qemu-kvm-10:1.5.3-175.el7_9.3, qemu-kvm-common-10:1.5.3-175.el7_9.3 +1
- Red Hat Enterprise Linux Server (v. 7) qemu-img-10:1.5.3-175.el7_9.3, qemu-kvm-10:1.5.3-175.el7_9.3, qemu-kvm-common-10:1.5.3-175.el7_9.3 +1
- Red Hat Enterprise Linux Workstation (v. 7) qemu-img-10:1.5.3-175.el7_9.3, qemu-kvm-10:1.5.3-175.el7_9.3, qemu-kvm-common-10:1.5.3-175.el7_9.3 +1
Fixes 2 records
Priority LOW 30
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS 3.1MEDIUM 5.6· Network · No auth · No interaction · EPSS 0.02458 · Published 2020-06-04 · Partial fix CWE-787
Priority LOW 18
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing.
CVSS 3.1LOW 3.8· Local · Low privileges · No interaction · EPSS 0.00377 · Published 2020-08-11 · Partial fix CWE-617
