gvisor-tap-vsock-0.7.3-4.el9_4.ML.1
エラータID: AXSA:2024-8546:03
Release date:
Wednesday, July 10, 2024 - 13:41
Subject:
gvisor-tap-vsock-0.7.3-4.el9_4.ML.1
Affected Channels:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
network stack of gVisor and is used to provide networking for podman-machine
virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable
DNS server and dynamic port forwarding.
Security Fix(es):
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA
payloads (CVE-2024-1394)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
CVE(s):
CVE-2024-1394
Solution:
Update packages.
CVEs:
CVE-2024-1394
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.
Additional Info:
N/A
Download:
SRPMS
- gvisor-tap-vsock-0.7.3-4.el9_4.ML.1.src.rpm
MD5: 360f871f7e0267001e06cfd3dd238cbc
SHA-256: eef3d56d5e4c30aeada4cbae36661ff03b626449b0ec142050b726d41c205154
Size: 9.75 MB
Asianux Server 9 for x86_64
- gvisor-tap-vsock-0.7.3-4.el9_4.ML.1.x86_64.rpm
MD5: 1b4d26cc16bd3fdb52cfbe803cebb1b8
SHA-256: 4bf525a5fd35cf66b1adf6d6ab143b07a7dd6c42ea3964cb021d080776bd0757
Size: 5.23 MB
日本語