RHSA-2022:5439HighCVSS 8.8

Red Hat Security Advisory: RHV-H security update (redhat-virtualization-host) 4.3.23

Published
July 1, 2022
Last Modified
August 6, 2026

🔗 CVE IDs covered (5)

CVE-2022-32250 →CVE-2018-25032 →CVE-2022-1271 →CVE-2022-1966 · pendingCVE-2022-24903 →

📋 Description

CVE-2018-25032 — zlib: A flaw found in zlib when compressing (not decompressing) certain inputs CVE-2022-1271 — gzip: arbitrary-file-write vulnerability CVE-2022-1966 — kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check leads to a use-after-free (write) CVE-2022-24903 — rsyslog: Heap-based overflow in TCP syslog server CVE-2022-32250 — kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root

🎯 Affected products11

  • RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Virtualization 4 Hypervisor for RHEL 7
  • redhat-release-virtualization-host-0:4.3.23-1.el7ev.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-0:4.3.23-1.el7ev.x86_64 as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.3.23-20220622.0.el7_9.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.3.23-20220622.0.el7_9.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7
  • redhat-virtualization-host-image-update-0:4.3.23-20220622.0.el7_9.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-image-update-0:4.3.23-20220622.0.el7_9.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7
  • redhat-virtualization-host-image-update-placeholder-0:4.3.23-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-productimg-0:4.3.23-1.el7.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-productimg-0:4.3.23-1.el7.x86_64 as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 Workaround: Red Hat has investigated whether possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

🔗 References (8)