The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5821 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow (CVE-2021-4206)

    * QEMU: QXL: double fetch in qxl_cursor() can lead to heap buffer overflow (CVE-2021-4207)

    * QEMU: virtio-net: map leaking on error during receive (CVE-2022-26353)

    * QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak (CVE-2022-26354)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL 9.0 guest with vsock device migration failed from RHEL 9.0 > RHEL 8.6 (BZ#2071103)

    * Fail to rebuild the reference count tables of qcow2 image on host block devices (e.g. LVs) (BZ#2072242)

    * Remove upstream-only devices from the qemu-kvm binary (BZ#2077928)

    * When doing a cpu-baseline between skylake and cascadelake, cascadelake is selected as baseline.
    (BZ#2084030)

    * Virt-v2v can't convert rhel8.6 guest from VMware on rhel8.6 (BZ#2093415)

    Enhancement(s):

    * Allow memory prealloc from multiple threads (BZ#2075569)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:5821)

high Nessus Plugin ID 163729

Version 1.6