(RHSA-2022:0841) Important: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.10] Async #1

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host’s resources and performing administrative tasks.

Security Fix(es):

• kernel: improper initialization of the “flags” member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

• cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands (CVE-2022-24407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.