sssctlruncommand() is a wrapper for running commands via a shell, using glibc's system() function call. sssctlcacheexpire() and sssctllogsfetch() allow user provided arguments, and pass them to sssctlruncommand() sssctl is limited to root user, however, if an administrator allows unprivileged users to provide arguments to the command (e.g.: via sudo), this could be used to elevate privileges via a shell injection.

Although there are no known default configuration where this flaw could be exploited, the admin could have manually created sudo rules to let regular users use sssctl commands, or could be tricked into running a specially crafted sssctl command.

References:

https://sssd.io/release-notes/sssd-2.6.0.html

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include maxworkerprocesses=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss.

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nwproto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

A flaw was found in cockpit web server that may lead to denial of server through sending crafted invalid base64 headers.

References:

https://bugzilla.redhat.com/showbug.cgi?id=1659542

Upstream issue:

https://github.com/cockpit-project/cockpit/pull/10819

Upstream patch:

https://github.com/cockpit-project/cockpit/commit/c51f6177576d7e12

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash.

Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.

Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredirhandledestroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

Quick Emulator(Qemu) built with the RTL8139 ethernet controller emulation support is vulnerable to an infinite loop issue. It could occur while transmitting packets in C+ mode of operation.

A privileged user inside guest could use this flaw to consume excessive CPU cycles on the host, resulting in DoS situation.

Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/10/24/5

Quick Emulator(Qemu) built with the Intel HDA controller emulation support is vulnerable to an infinite loop issue. It could occur while processing the DMA buffer stream while doing data transfer in 'intelhdaxfer'.

A privileged user inside guest could use this flaw to consume excessive CPU cycles on the host, resulting in DoS.

Upstream patch -------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04717.html

Quick Emulator(Qemu) built with the 16550A UART emulation support is vulnerable to a divide by zero issue. It could occur while updating serial device parameters in 'serialupdateparameters'.

A privileged guest user could use this flaw to crash the Qemu process instance on the host, resulting in DoS.

Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02461.html

Quick Emulator(Qemu) built with the USB xHCI controller emulation support is vulnerable to an infinite loop issue. It could occur while processing USB command ring in 'xhciringfetch'.

A privileged user/process inside guest could use this issue to crash the Qemu process on the host leading to DoS.

Upstream patch -------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01265.html

Quick emulator(Qemu) built with the virtio framework is vulnerable to a null pointer dereference flaw. It could occur if the guest was to set the I/O descriptor buffer length to a large value.

A privileged user inside guest could use this flaw to crash the Qemu instance on the host resulting in DoS.

Upstream fix: ------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03546.html

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/09/16/4

Memory leak in the usbxhciexit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.

Integer overflow in the nettxpktinit function in hw/net/nettxpkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.

Quick Emulator(Qemu) built with the VMWARE VMXNET3 NIC device support is vulnerable to an OOB access issue. In that it does not check if packet headers does not check for IP header length. It could lead to a OOB access when reading further packet data.

A privileged user inside guest could use this issue to crash the Qemu process instance or potentially execute arbitrary code on the host, with privileges of the Qemu process.

Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-stable/2016-08/msg00077.html

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/08/18/4

Greg Sheremeta of Red Hat reports:

We've found a scenario a webadmin session won't timeout and force a logout. We had a CVE on this before.

To duplicate: navigate to the Data Centers tab. Select a data center. Switch to another browser tab and wait longer than the engine timeout period [1] to switch back to webadmin. You won't be logged out -- even though you should be.

Basically, idling while certain things in the UI are selected (a data center, a cluster -- maybe others?) will prevent the session from timing out. We see three gluster queries that are repeating and keeping the session open. Alexander is looking for others. We know the fix -- just have to find them all.

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

Qemu emulator built with the Task Priority Register(TPR) optimizations for 32-bit Windows guests, is vulnerable to a information leakage issue. It could occur while accessing Task Priority Register(TPR).

A privileged user/process inside guest could use this issue to leak host memory bytes.

Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/04/14/3

The netchecksumcalculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the 'servergetspec' function via the 'gfgetspecreq' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact.

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory.

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server.

The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GFXATTRCLRLKCMD' xattr in the 'plgetxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GFMETALOCKKEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.

A vulnerability was found in Gluster's features/locks translator An user-controlled string is given to snprintf without a proper format string. Sending a specially crafted string would result in a denial of service.

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.