RHSA-2022:1759MediumCVSS 8.5

Red Hat Security Advisory: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Published
May 10, 2022
Last Modified
November 6, 2026

🔗 CVE IDs covered (30)

CVE-2021-39254 →CVE-2021-39258 →CVE-2021-39260 →CVE-2021-3622 →CVE-2021-35268 →CVE-2021-3748 →CVE-2021-20196 →CVE-2021-33285 →CVE-2021-33286 →CVE-2021-39253 →CVE-2021-39259 →CVE-2021-3975 →CVE-2021-4158 →CVE-2022-0485 →CVE-2021-3716 →CVE-2021-3682 →CVE-2021-4145 →CVE-2021-33289 →CVE-2021-35269 →CVE-2021-39255 →CVE-2021-39256 →CVE-2021-39257 →CVE-2021-39261 →CVE-2021-35266 →CVE-2021-35267 →CVE-2021-39252 →CVE-2021-39262 →CVE-2021-39263 →CVE-2021-33287 →CVE-2021-39251 →

📋 Description

CVE-2021-3622 — hivex: stack overflow due to recursive call of _get_children() CVE-2021-3682 — QEMU: usbredir: free() call on invalid pointer in bufp_alloc() CVE-2021-3716 — nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS CVE-2021-3748 — QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu CVE-2021-3975 — libvirt: segmentation fault during VM shutdown can lead to vdsm hang CVE-2021-4145 — QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c CVE-2021-4158 — QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c CVE-2021-20196 — QEMU: block: fdc: null pointer dereference may lead to guest crash CVE-2021-33285 — ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records CVE-2021-33286 — ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string CVE-2021-33287 — ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes CVE-2021-33289 — ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section CVE-2021-35266 — ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname CVE-2021-35267 — ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections CVE-2021-35268 — ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode CVE-2021-35269 — ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT CVE-2021-39251 — ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() CVE-2021-39252 — ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() CVE-2021-39253 — ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() CVE-2021-39254 — ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() CVE-2021-39255 — ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute CVE-2021-39256 — ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() CVE-2021-39257 — ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap CVE-2021-39258 — ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() CVE-2021-39259 — ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length CVE-2021-39260 — ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() CVE-2021-39261 — ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() CVE-2021-39262 — ntfs-3g: Out-of-bounds access in ntfs_decompress() CVE-2021-39263 — ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute CVE-2022-0485 — libnbd: nbdcopy: missing error handling may create corrupted destination image

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • SLOF-0:20210217-1.module+el8.6.0+14480+c0a3aa0f.noarch (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • SLOF-0:20210217-1.module+el8.6.0+14480+c0a3aa0f.src (virt-devel:rhel) as a component of Red Hat Enterprise Linux CRB (v. 8)
  • SLOF-0:20210217-1.module+el8.6.0+14480+c0a3aa0f.src (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686 (virt-devel:rhel) as a component of Red Hat Enterprise Linux CRB (v. 8)
  • hivex-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.ppc64le (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.s390x (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.src (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debuginfo-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debuginfo-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686 (virt-devel:rhel) as a component of Red Hat Enterprise Linux CRB (v. 8)
  • hivex-debuginfo-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.ppc64le (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debuginfo-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.s390x (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debuginfo-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debugsource-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debugsource-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686 (virt-devel:rhel) as a component of Red Hat Enterprise Linux CRB (v. 8)
  • hivex-debugsource-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.ppc64le (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debugsource-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.s390x (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-debugsource-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-devel-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-devel-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.i686 (virt-devel:rhel) as a component of Red Hat Enterprise Linux CRB (v. 8)
  • hivex-devel-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.ppc64le (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-devel-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.s390x (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • hivex-devel-0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libguestfs-1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f.aarch64 (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libguestfs-1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f.ppc64le (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libguestfs-1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f.s390x (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libguestfs-1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f.src (virt:rhel) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: In general, it is recommended to use forced TLS (--tls=require) to avoid MitM attacks in the first place. If opportunistic encryption must be used (--tls=yes), ensure that clients that want to use TLS will request structured replies after the encryption is enabled. If this cannot be done, apply network filtering (e.g., firewall, TCP wrappers, etc.) or use a Unix domain socket instead of TCP to ensure that untrusted clients cannot connect to nbdkit as a MitM attacker. Workaround: Use of `nbdcopy --synchronous` will avoid undetected data corruption, but comes at a potential performance cost by avoiding the speed benefits of asynchronous operations. See the upstream security advisory for more information.

🔗 References (131)