CVE-2022-0897

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0). (BZ#2066828)

Security Fix(es):

• QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

• libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

• libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

• swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313)

Security Fix(es):

• libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313)

Security Fix(es):

• libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-0897: nwfilter: fix crash when counting number of network filters

• CVE-2022-0897: nwfilter: fix crash when counting number of network filters

• CVE-2021-3631: Fix insecure sVirt label generation (single-category MCS labels) in virSecuritySELinuxMCSFind()
• CVE-2021-3975: Fix use-after-free due to missing monitor lock in qemuProcessHandleMonitorEOF()
• CVE-2022-0897: Fix missing locking in nwfilterConnectNumOfNWFilters() (DoS)
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus()
• Fix udev device reference leak on NULL interface names in udevListInterfacesByStatus() and udevConnectListAllInterfaces()

• CVE-2021-3631: Fix insecure sVirt label generation (single-category MCS labels) in virSecuritySELinuxMCSFind()
• CVE-2021-3975: Fix use-after-free due to missing monitor lock in qemuProcessHandleMonitorEOF()
• CVE-2022-0897: Fix missing locking in nwfilterConnectNumOfNWFilters() (DoS)
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus()
• Fix udev device reference leak on NULL interface names in udevListInterfacesByStatus() and udevConnectListAllInterfaces()

A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

These are all security issues fixed in the libvirt-8.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libvirt fixes the following issues:

• CVE-2022-0897: Fixed a crash in nwfilter when counting number of network filters (bsc#1197636).

The following non-security bugs were fixed:

• libxl: Mark auto-allocated graphics ports to used on reconnect e0241f33-libxl-mark-allocated-graphics-ports.patch
• libxl: Release all auto-allocated graphics ports 18ec405a-libxl-release-graphics-ports.patch bsc#1191668

This update for libvirt fixes the following issues:

• CVE-2022-0897: Fixed a crash in nwfilter when counting number of network filters (bsc#1197636).

The following non-security bugs were fixed:

• qemu: Improve save operation by increasing pipe size c61d1e9b-virfile-set-pipe-size.patch, 47d6d185-virfile-fix-indent.patch, cd7acb33-virfile-report-error.patch bsc#1196625

• qemu: Directly query KVM for TSC scaling support 5df2c492-use-kvm-for-tsc-scaling.patch bsc#1193364

This update for libvirt fixes the following issues:

• CVE-2022-0897: Fixed crash when counting number of network filters (bsc#1197636).

Bug fixes:

• qemu: Fixed potential crash during driver cleanup (bsc#1209861).
• libxl: Marked auto-allocated graphics ports to used on reconnect.
• libxl: Released all auto-allocated graphics ports (bsc#1191668).
• libxl: Added lock process indicator to saved VM state (bsc#1191668).

It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3667)

It was discovered that libvirt incorrectly handled threads during shutdown. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3975)

It was discovered that libvirt incorrectly handled the libxl driver. An attacker inside a guest could possibly use this issue to cause libvirtd to crash or stop responding, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2021-4147)

It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2022-0897)

It was discovered that libvirt incorrectly handled the polkit access control driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-25637)

It was discovered that libvirt incorrectly generated SELinux labels. In environments using SELinux, this issue could allow the sVirt confinement to be bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3631)

It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-0897)

It was discovered that libvirt incorrectly handled queries for the SR-IOV PCI device capabilities. A local attacker could possibly use this issue to cause libvirt to consume resources, leading to a denial of service. (CVE-2023-2700)