RHSA-2022:4896HighCVSS 8.8

Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update [ovirt-4.5.0]

Published
June 3, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2022-24903 →CVE-2022-25636 →CVE-2018-25032 →CVE-2021-4028 →CVE-2021-4083 →CVE-2022-0778 →CVE-2022-1271 →

📋 Description

CVE-2018-25032 — zlib: A flaw found in zlib when compressing (not decompressing) certain inputs CVE-2021-4028 — kernel: use-after-free in RDMA listen() CVE-2021-4083 — kernel: fget: check that the fd still exists after getting a ref to it CVE-2022-0778 — openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVE-2022-1271 — gzip: arbitrary-file-write vulnerability CVE-2022-24903 — rsyslog: Heap-based overflow in TCP syslog server CVE-2022-25636 — kernel: heap out of bounds write in nf_dup_netdev.c

🎯 Affected products25

  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-0:0.186-1.el8.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfo-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfod-client-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfod-client-debuginfo-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfod-debuginfo-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debugsource-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-devel-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-libelf-debuginfo-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-libs-debuginfo-0:0.186-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • imgbased-0:1.2.24-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • imgbased-0:1.2.24-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • ovirt-node-ng-0:4.4.2-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • ovirt-node-ng-nodectl-0:4.4.2-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • python3-imgbased-0:1.2.24-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • python3-ovirt-node-ng-nodectl-0:4.4.2-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-0:4.5.0-5.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-0:4.5.0-5.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-content-0:4.5.0-5.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.5.0-202205291010_8.6.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-virtualization-host-image-update-0:4.5.0-202205291010_8.6.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-virtualization-host-image-update-placeholder-0:4.5.0-5.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-productimg-0:4.5.0-2.el8.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-productimg-0:4.5.0-2.el8.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 Workaround: Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Red Hat has investigated whether possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: The mitigation for the Red Hat Enterprise Linux 8 is to disable for unprivileged user possibilities of running unshare(CLONE_NEWUSER) or unshare(CLONE_NEWNET) that could be done with the next command: echo 0 > /proc/sys/user/max_user_namespaces For making this change in configuration permanent. Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable. Configure RHEL 8 to disable the use of user namespaces by adding the following line to a file in the "/etc/sysctl.d/" directory: user.max_user_namespaces = 0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command: $ sudo sysctl --system The other mitigation for containers, if without disabling user namespaces, is blocking the pertinent syscalls in a seccomp policy file. For more information about seccomp, please read: https://www.openshift.com/blog/seccomp-for-fun-and-profit

🔗 References (21)