ELSA-2022-9123

ELSA-2022-9123 - qemu security update

Type:	SECURITY
Severity:	IMPORTANT
Release Date:	2022-02-05

Description

[15:4.2.1-15.el7]
- Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda) [Orabug: 33719302] [Orabug: 33754145] {CVE-2021-3947} {CVE-2021-4158}
- hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daude) [Orabug: 32439466] {CVE-2021-20196}
- hw/block/fdc: Extract blk_create_empty_drive() (Philippe Mathieu-Daude) [Orabug: 32439466] {CVE-2021-20196}
- net: vmxnet3: validate configuration values during activate (CVE-2021-20203) (Prasad J Pandit) [Orabug: 32559476] {CVE-2021-20203}
- lan9118: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
- pcnet: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
- rtl8139: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
- tx_pkt: switch to use qemu_receive_packet_iov() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- sungem: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- dp8393x: switch to use qemu_receive_packet() for loopback packet (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- e1000: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- net: introduce qemu_receive_packet() (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
- target/i386: Populate x86_ext_save_areas offsets using cpuid where possible (David Edmondson)
- target/i386: Observe XSAVE state area offsets (David Edmondson)
- target/i386: Make x86_ext_save_areas visible outside cpu.c (David Edmondson)
- target/i386: Pass buffer and length to XSAVE helper (David Edmondson)
- target/i386: Clarify the padding requirements of X86XSaveArea (David Edmondson)
- target/i386: Consolidate the X86XSaveArea offset checks (David Edmondson)
- target/i386: Declare constants for XSAVE offsets (David Edmondson)

Related CVEs

CVE-2021-3416

CVE-2021-20203

CVE-2021-4158

CVE-2021-20196

CVE-2021-3947

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory
Oracle Linux 7 (aarch64)	qemu-4.2.1-15.el7.src.rpm	8db3e21afa500100d533f0a0d971bea9	-
	ivshmem-tools-4.2.1-15.el7.aarch64.rpm	e2b1e82c73421fc28e75e1402ccfd1ce	-
	qemu-4.2.1-15.el7.aarch64.rpm	cbca6a1af9f4baac5b55891fa7fd651a	-
	qemu-block-gluster-4.2.1-15.el7.aarch64.rpm	827ab5dd627868eaad2736ca201d3656	-
	qemu-block-iscsi-4.2.1-15.el7.aarch64.rpm	c64eb72ae59e17ecb736bd3f69fa1610	-
	qemu-block-rbd-4.2.1-15.el7.aarch64.rpm	77e046dd00d1fe5f6c866ab3aef1528f	-
	qemu-common-4.2.1-15.el7.aarch64.rpm	01a8fdb19ba43b29443733ed541fa8e8	-
	qemu-img-4.2.1-15.el7.aarch64.rpm	7abebc3e7b177200e444c4a385a18e8e	-
	qemu-kvm-4.2.1-15.el7.aarch64.rpm	ce0017a43fc7af1d66c3ac4c31c6a259	-
	qemu-kvm-core-4.2.1-15.el7.aarch64.rpm	968e14a3e96c45eaaaf903a8fe3384b8	-
	qemu-system-aarch64-4.2.1-15.el7.aarch64.rpm	c04675ed29c6de7825788ec1768fcbec	-
	qemu-system-aarch64-core-4.2.1-15.el7.aarch64.rpm	14f8f1454648f8baf10345908d4d7e13	-
Oracle Linux 7 (x86_64)	qemu-4.2.1-15.el7.src.rpm	8db3e21afa500100d533f0a0d971bea9	-
	qemu-4.2.1-15.el7.x86_64.rpm	a7016e8c88f8573d87230de0d81abe3b	-
	qemu-block-gluster-4.2.1-15.el7.x86_64.rpm	0057662331621f976e40e46c7bde2925	-
	qemu-block-iscsi-4.2.1-15.el7.x86_64.rpm	4c0747a670d6695a3bd5438f48bc4af5	-
	qemu-block-rbd-4.2.1-15.el7.x86_64.rpm	be60b53fd204e869e271f411848b0133	-
	qemu-common-4.2.1-15.el7.x86_64.rpm	f10bfa84ff0507b4ed0cde67f2a4e7f7	-
	qemu-img-4.2.1-15.el7.x86_64.rpm	08b72dba7a8a9eaae55292a672f3aa8e	-
	qemu-kvm-4.2.1-15.el7.x86_64.rpm	42d446829a911305868ee35b915f4ffc	-
	qemu-kvm-core-4.2.1-15.el7.x86_64.rpm	c935d6a2f0a23948de4c66059e323c51	-
	qemu-system-x86-4.2.1-15.el7.x86_64.rpm	718bd716fd902ead8ff1c2ee974b4c03	-
	qemu-system-x86-core-4.2.1-15.el7.x86_64.rpm	a521f3fdfb708c93724a719e7b32e4c6	-

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team