Security Vulnerabilities fixed in qemu-kvm RHSA-2022:5263

Description

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): QEMU: virtio-net: map leaking on error during receive (CVE-2022-26353) QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak (CVE-2022-26354) QEMU: virtio-net: map leaking on error during receive (CVE-2022-26353) QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak (CVE-2022-26354) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): RHEL 9.0 guest with vsock device migration failed from RHEL 9.0 > RHEL 8.6 (BZ#2071102) SolutionFor details on how to apply this update, which includes the changes described in this advisory, refer to:https://access.redhat.com/articles/11258 After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Affected Applications

qemu-kvm

CVE References

CVE-2022-26353 CVE-2022-26354

Other References

https://access.redhat.com/errata/RHSA-2022:5263