Red Hat OpenStack 8

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

Published: 2018-05-22T12:00:00.000Z
Updated: 2026-05-29T20:14:05.872Z

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Published: 2018-04-24T18:00:00.000Z
Updated: 2024-09-17T00:46:47.514Z

Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.

Published: 2018-10-19T22:00:00.000Z
Updated: 2024-08-05T11:08:21.832Z

m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.

Published: 2018-06-13T16:00:00.000Z
Updated: 2024-08-05T08:17:09.239Z

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

Published: 2018-03-05T14:00:00.000Z
Updated: 2024-08-05T12:33:49.333Z