Oracle Linux: CVE-2021-33285: ELSA-2022-1759: virt:ol and virt-devel:ol security, bug fix, and enhancement update (MODERATE) (Multiple Advisories)
7
(AV:L/AC:L/Au:S/C:C/I:C/A:C)
08/30/2021
05/20/2022
05/18/2022
11/25/2024
Description
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild. The ntfs3g package is susceptible to a heap overflow on crafted input. When processing NTFS attributes, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Solution(s)
- oracle-linux-upgrade-hivex
- oracle-linux-upgrade-hivex-devel
- oracle-linux-upgrade-libguestfs
- oracle-linux-upgrade-libguestfs-appliance
- oracle-linux-upgrade-libguestfs-bash-completion
- oracle-linux-upgrade-libguestfs-devel
- oracle-linux-upgrade-libguestfs-gfs2
- oracle-linux-upgrade-libguestfs-gobject
- oracle-linux-upgrade-libguestfs-gobject-devel
- oracle-linux-upgrade-libguestfs-inspect-icons
- oracle-linux-upgrade-libguestfs-java
- oracle-linux-upgrade-libguestfs-java-devel
- oracle-linux-upgrade-libguestfs-javadoc
- oracle-linux-upgrade-libguestfs-man-pages-ja
- oracle-linux-upgrade-libguestfs-man-pages-uk
- oracle-linux-upgrade-libguestfs-rescue
- oracle-linux-upgrade-libguestfs-rsync
- oracle-linux-upgrade-libguestfs-tools
- oracle-linux-upgrade-libguestfs-tools-c
- oracle-linux-upgrade-libguestfs-winsupport
- oracle-linux-upgrade-libguestfs-xfs
- oracle-linux-upgrade-libiscsi
- oracle-linux-upgrade-libiscsi-devel
- oracle-linux-upgrade-libiscsi-utils
- oracle-linux-upgrade-libnbd
- oracle-linux-upgrade-libnbd-bash-completion
- oracle-linux-upgrade-libnbd-devel
- oracle-linux-upgrade-libtpms
- oracle-linux-upgrade-libtpms-devel
- oracle-linux-upgrade-libvirt
- oracle-linux-upgrade-libvirt-client
- oracle-linux-upgrade-libvirt-daemon
- oracle-linux-upgrade-libvirt-daemon-config-network
- oracle-linux-upgrade-libvirt-daemon-config-nwfilter
- oracle-linux-upgrade-libvirt-daemon-driver-interface
- oracle-linux-upgrade-libvirt-daemon-driver-network
- oracle-linux-upgrade-libvirt-daemon-driver-nodedev
- oracle-linux-upgrade-libvirt-daemon-driver-nwfilter
- oracle-linux-upgrade-libvirt-daemon-driver-qemu
- oracle-linux-upgrade-libvirt-daemon-driver-secret
- oracle-linux-upgrade-libvirt-daemon-driver-storage
- oracle-linux-upgrade-libvirt-daemon-driver-storage-core
- oracle-linux-upgrade-libvirt-daemon-driver-storage-disk
- oracle-linux-upgrade-libvirt-daemon-driver-storage-gluster
- oracle-linux-upgrade-libvirt-daemon-driver-storage-iscsi
- oracle-linux-upgrade-libvirt-daemon-driver-storage-iscsi-direct
- oracle-linux-upgrade-libvirt-daemon-driver-storage-logical
- oracle-linux-upgrade-libvirt-daemon-driver-storage-mpath
- oracle-linux-upgrade-libvirt-daemon-driver-storage-rbd
- oracle-linux-upgrade-libvirt-daemon-driver-storage-scsi
- oracle-linux-upgrade-libvirt-daemon-kvm
- oracle-linux-upgrade-libvirt-dbus
- oracle-linux-upgrade-libvirt-devel
- oracle-linux-upgrade-libvirt-docs
- oracle-linux-upgrade-libvirt-libs
- oracle-linux-upgrade-libvirt-lock-sanlock
- oracle-linux-upgrade-libvirt-nss
- oracle-linux-upgrade-libvirt-wireshark
- oracle-linux-upgrade-lua-guestfs
- oracle-linux-upgrade-nbdfuse
- oracle-linux-upgrade-nbdkit
- oracle-linux-upgrade-nbdkit-bash-completion
- oracle-linux-upgrade-nbdkit-basic-filters
- oracle-linux-upgrade-nbdkit-basic-plugins
- oracle-linux-upgrade-nbdkit-curl-plugin
- oracle-linux-upgrade-nbdkit-devel
- oracle-linux-upgrade-nbdkit-example-plugins
- oracle-linux-upgrade-nbdkit-gzip-filter
- oracle-linux-upgrade-nbdkit-gzip-plugin
- oracle-linux-upgrade-nbdkit-linuxdisk-plugin
- oracle-linux-upgrade-nbdkit-nbd-plugin
- oracle-linux-upgrade-nbdkit-python-plugin
- oracle-linux-upgrade-nbdkit-server
- oracle-linux-upgrade-nbdkit-ssh-plugin
- oracle-linux-upgrade-nbdkit-tar-filter
- oracle-linux-upgrade-nbdkit-tar-plugin
- oracle-linux-upgrade-nbdkit-tmpdisk-plugin
- oracle-linux-upgrade-nbdkit-vddk-plugin
- oracle-linux-upgrade-nbdkit-xz-filter
- oracle-linux-upgrade-netcf
- oracle-linux-upgrade-netcf-devel
- oracle-linux-upgrade-netcf-libs
- oracle-linux-upgrade-ocaml-hivex
- oracle-linux-upgrade-ocaml-hivex-devel
- oracle-linux-upgrade-ocaml-libguestfs
- oracle-linux-upgrade-ocaml-libguestfs-devel
- oracle-linux-upgrade-ocaml-libnbd
- oracle-linux-upgrade-ocaml-libnbd-devel
- oracle-linux-upgrade-perl-hivex
- oracle-linux-upgrade-perl-sys-guestfs
- oracle-linux-upgrade-perl-sys-virt
- oracle-linux-upgrade-python3-hivex
- oracle-linux-upgrade-python3-libguestfs
- oracle-linux-upgrade-python3-libnbd
- oracle-linux-upgrade-python3-libvirt
- oracle-linux-upgrade-qemu-guest-agent
- oracle-linux-upgrade-qemu-img
- oracle-linux-upgrade-qemu-kvm
- oracle-linux-upgrade-qemu-kvm-block-curl
- oracle-linux-upgrade-qemu-kvm-block-gluster
- oracle-linux-upgrade-qemu-kvm-block-iscsi
- oracle-linux-upgrade-qemu-kvm-block-rbd
- oracle-linux-upgrade-qemu-kvm-block-ssh
- oracle-linux-upgrade-qemu-kvm-common
- oracle-linux-upgrade-qemu-kvm-core
- oracle-linux-upgrade-qemu-kvm-docs
- oracle-linux-upgrade-qemu-kvm-hw-usbredir
- oracle-linux-upgrade-qemu-kvm-tests
- oracle-linux-upgrade-qemu-kvm-ui-opengl
- oracle-linux-upgrade-qemu-kvm-ui-spice
- oracle-linux-upgrade-ruby-hivex
- oracle-linux-upgrade-ruby-libguestfs
- oracle-linux-upgrade-seabios
- oracle-linux-upgrade-seabios-bin
- oracle-linux-upgrade-seavgabios-bin
- oracle-linux-upgrade-sgabios
- oracle-linux-upgrade-sgabios-bin
- oracle-linux-upgrade-supermin
- oracle-linux-upgrade-supermin-devel
- oracle-linux-upgrade-swtpm
- oracle-linux-upgrade-swtpm-devel
- oracle-linux-upgrade-swtpm-libs
- oracle-linux-upgrade-swtpm-tools
- oracle-linux-upgrade-swtpm-tools-pkcs11
- oracle-linux-upgrade-virt-dib
- oracle-linux-upgrade-virt-v2v
- oracle-linux-upgrade-virt-v2v-bash-completion
- oracle-linux-upgrade-virt-v2v-man-pages-ja
- oracle-linux-upgrade-virt-v2v-man-pages-uk
Advanced vulnerability management analytics and reporting.
Key Features
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center