Red Hat OpenStack Platform 13 (Queens).

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Broken access control

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-672

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Denial of service

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: double offset bug in vhost log mapping calculation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

• Red Hat Fast Datapath for RHEL 7
• Red Hat Fast Datapath for RHEL 8
• Memory corruption

Ovn: insufficient validation of bfd packets may lead to denial of service

• Fast Datapath for Red Hat Enterprise Linux 8
• Fast Datapath for Red Hat Enterprise Linux 9
• CWE-346

Service monitor mac flow is not rate limited

• ovn
• Red Hat Fast Datapath for RHEL 7
• Denial of service

Dma reentrancy issue (incomplete fix for cve-2021-3750)

• qemu
• Red Hat Enterprise Linux 6
• Memory corruption

Triggerable assertion due to race condition in hot-unplug

• qemu
• Red Hat Enterprise Linux 6
• Denial of service

Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service

• qemu
• Red Hat Enterprise Linux 6
• Memory corruption