gvisor-tap-vsock-0.7.3-4.el9_4.ML.1
エラータID: AXSA:2024-8546:03
Release date:
Wednesday, July 10, 2024 - 13:41
Subject:
gvisor-tap-vsock-0.7.3-4.el9_4.ML.1
Affected Channels:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
network stack of gVisor and is used to provide networking for podman-machine
virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable
DNS server and dynamic port forwarding.
Security Fix(es):
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA
payloads (CVE-2024-1394)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
CVE(s):
CVE-2024-1394
Solution:
Update packages.
CVEs:
CVE-2024-1394
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
Additional Info:
N/A
Download:
SRPMS
- gvisor-tap-vsock-0.7.3-4.el9_4.ML.1.src.rpm
MD5: 360f871f7e0267001e06cfd3dd238cbc
SHA-256: eef3d56d5e4c30aeada4cbae36661ff03b626449b0ec142050b726d41c205154
Size: 9.75 MB
Asianux Server 9 for x86_64
- gvisor-tap-vsock-0.7.3-4.el9_4.ML.1.x86_64.rpm
MD5: 1b4d26cc16bd3fdb52cfbe803cebb1b8
SHA-256: 4bf525a5fd35cf66b1adf6d6ab143b07a7dd6c42ea3964cb021d080776bd0757
Size: 5.23 MB
日本語