Red Hat Security Advisory

RHSA-2023:1833

virt:rhel and virt-devel:rhel security and bug fix update

Released 2023-04-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.8.6) SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.src::virt-devel:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686::virt-devel:rhel, hivex-devel-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686::virt-devel:rhel +47
Red Hat Enterprise Linux AppStream EUS (v.8.6) SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.noarch::virt:rhel, SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.src::virt:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64::virt:rhel +47

Fixes 2 records

TI-2023-00962 CVE-2023-1017 · GHSA-c6qh-28m2-rfvf

TPM2.0 vulnerable to out-of-bounds write

LOW 37

An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01379 Published 2023-02-28 Partial fix CWE-787

TI-2023-00963 CVE-2023-1018 · GHSA-cr8w-xxqw-fm2m

TPM2.0 vulnerable to out-of-bounds read

LOW 33

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.05552 Published 2023-02-28 Partial fix CWE-125