Bug 2063257 (CVE-2022-26354)

Summary: CVE-2022-26354 QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: berrange, cfergeau, crobinso, dbecker, f4bug, jen, jferlan, jjoyce, jmaloy, jschluet, knoel, lhh, lkundrak, lpeer, mburns, mkenneth, mrezanin, mst, ondrejj, pbonzini, ribarry, rjones, sclewis, slinaber, virt-maint, virt-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2063258, 2063262, 2063264, 2063261, 2063263, 2075639, 2075640    
Bug Blocks: 2063249    

Description Mauro Matteo Cascella 2022-03-11 16:11:40 UTC
A flaw was found in the vhost-vsock device of QEMU. In case of error, vhost_vsock_common_send_transport_reset() did not detach the invalid element from the virtqueue before freeing its memory, leading to memory leakage or other unexpected results.

Upstream commit:
https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf

Comment 1 Mauro Matteo Cascella 2022-03-11 16:14:09 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2063258]

Comment 4 errata-xmlrpc 2022-06-13 11:51:37 UTC
This issue has been addressed in the following products:

  Advanced Virtualization for RHEL 8.4.0.EUS

Via RHSA-2022:5002 https://access.redhat.com/errata/RHSA-2022:5002

Comment 5 errata-xmlrpc 2022-06-28 16:06:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5263 https://access.redhat.com/errata/RHSA-2022:5263

Comment 6 errata-xmlrpc 2022-08-02 10:01:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5821 https://access.redhat.com/errata/RHSA-2022:5821