what you don't know can hurt you

Red Hat Security Advisory 2017-2408-01

Red Hat Security Advisory 2017-2408-01
Posted Aug 2, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-2408-01 - KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix: Quick Emulator built with Network Block Device Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server.

tags | advisory, remote
systems | linux, redhat
advisories | CVE-2016-10155, CVE-2016-4020, CVE-2016-6888, CVE-2016-7422, CVE-2016-7466, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375, CVE-2017-9524
MD5 | 43453dd199302989251381bee4c45dba

Red Hat Security Advisory 2017-2408-01

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: qemu-kvm-rhev security and bug fix update
Advisory ID: RHSA-2017:2408-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2408
Issue date: 2017-08-01
CVE Names: CVE-2016-10155 CVE-2016-4020 CVE-2016-6888
CVE-2016-7422 CVE-2016-7466 CVE-2016-8576
CVE-2016-8669 CVE-2016-8909 CVE-2016-8910
CVE-2016-9907 CVE-2016-9911 CVE-2016-9921
CVE-2016-9922 CVE-2017-5579 CVE-2017-5973
CVE-2017-6414 CVE-2017-8309 CVE-2017-8379
CVE-2017-9310 CVE-2017-9373 CVE-2017-9374
CVE-2017-9375 CVE-2017-9524
=====================================================================

1. Summary:

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux
OpenStack Platform 6.0 (Juno) for RHEL 7, Red Hat Enterprise Linux
OpenStack Platform 7.0 (Kilo) for RHEL 7, Red Hat OpenStack Platform 8.0
(Liberty), Red Hat OpenStack Platform 9.0 (Mitaka), Red Hat OpenStack
Platform 10.0 (Newton), and Red Hat OpenStack Platform 11.0 (Ocata).

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 - x86_64
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 - x86_64
Red Hat OpenStack Platform 10.0 - x86_64
Red Hat OpenStack Platform 11.0 - x86_64
Red Hat OpenStack Platform 8.0 (Liberty) - x86_64
Red Hat OpenStack Platform 9.0 - x86_64

3. Description:

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.

Security Fix(es):

* Quick Emulator (QEMU) built with Network Block Device (NBD) Server
support was vulnerable to a null-pointer dereference issue. The flaw could
occur when releasing a client that was not initialized due to failed
negotiation. A remote user or process could exploit this flaw to crash the
qemu-nbd server (denial of service). (CVE-2017-9524)

* An information-exposure flaw was found in Quick Emulator (QEMU) in Task
Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw
could occur while accessing TPR. A privileged user inside a guest could use
this issue to read portions of the host memory. (CVE-2016-4020)

* A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB
xHCI controller emulation support. The flaw could occur while doing a
USB-device unplug operation. Unplugging the device repeatedly resulted in
leaking host memory, which affected other services on the host. A
privileged user inside the guest could exploit this flaw to cause a denial
of service on the host or potentially crash the host's QEMU process
instance. (CVE-2016-7466)

* Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0.
(CVE-2016-6888, CVE-2016-7422, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909,
CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922,
CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309,
CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)

Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting
CVE-2016-4020; Li Qiang (Qihoo 360 Inc.) for reporting CVE-2016-6888;
Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team 360.cn
Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting
CVE-2016-7466, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and
CVE-2017-6414; PSIRT (Huawei Inc.) for reporting CVE-2016-8669; Andrew
Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910;
Qinghao Tang (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.)
for reporting CVE-2016-9921 and CVE-2016-9922; Jiang Xin (PSIRT, Huawei
Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang (Qihoo
360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374,
and CVE-2017-9375.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1313686 - CVE-2016-4020 Qemu: i386: leakage of stack memory to guest in kvmvapic.c
1333425 - CVE-2016-8576 Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch
1334398 - CVE-2016-9922 Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy
1369031 - CVE-2016-6888 Qemu: net: vmxnet: integer overflow in packet initialisation
1376755 - CVE-2016-7422 Qemu: virtio: null pointer dereference in virtqueu_map_desc
1377837 - CVE-2016-7466 Qemu: usb: xhci memory leakage during device unplug
1384909 - CVE-2016-8669 Qemu: char: divide by zero error in serial_update_parameters
1388046 - CVE-2016-8910 Qemu: net: rtl8139: infinite loop while transmit in C+ mode
1388052 - CVE-2016-8909 Qemu: audio: intel-hda: infinite loop in processing dma buffer stream
1402265 - CVE-2016-9907 Qemu: usb: redirector: memory leakage when destroying redirector
1402272 - CVE-2016-9911 Qemu: usb: ehci: memory leakage in ehci_init_transfer
1415199 - CVE-2016-10155 Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
1416157 - CVE-2017-5579 Qemu: serial: host memory leakage 16550A UART emulation
1421626 - CVE-2017-5973 Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx
1427833 - CVE-2017-6414 Qemu: libcacard: host memory leakage while creating new APDU
1446517 - CVE-2017-8309 Qemu: audio: host memory leakage via capture buffer
1446547 - CVE-2017-8379 Qemu: input: host memory lekage via keyboard events
1452620 - CVE-2017-9310 Qemu: net: infinite loop in e1000e NIC emulation
1458270 - CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug
1458744 - CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep
1459132 - CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug
1459661 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-11]
1459663 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-6]
1459664 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-7]
1459666 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-8]
1459667 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-9]
1459668 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-10]
1460170 - CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation

6. Package List:

Red Hat OpenStack Platform 10.0:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat OpenStack Platform 11.0:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat OpenStack Platform 8.0 (Liberty):

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat OpenStack Platform 9.0:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-10155
https://access.redhat.com/security/cve/CVE-2016-4020
https://access.redhat.com/security/cve/CVE-2016-6888
https://access.redhat.com/security/cve/CVE-2016-7422
https://access.redhat.com/security/cve/CVE-2016-7466
https://access.redhat.com/security/cve/CVE-2016-8576
https://access.redhat.com/security/cve/CVE-2016-8669
https://access.redhat.com/security/cve/CVE-2016-8909
https://access.redhat.com/security/cve/CVE-2016-8910
https://access.redhat.com/security/cve/CVE-2016-9907
https://access.redhat.com/security/cve/CVE-2016-9911
https://access.redhat.com/security/cve/CVE-2016-9921
https://access.redhat.com/security/cve/CVE-2016-9922
https://access.redhat.com/security/cve/CVE-2017-5579
https://access.redhat.com/security/cve/CVE-2017-5973
https://access.redhat.com/security/cve/CVE-2017-6414
https://access.redhat.com/security/cve/CVE-2017-8309
https://access.redhat.com/security/cve/CVE-2017-8379
https://access.redhat.com/security/cve/CVE-2017-9310
https://access.redhat.com/security/cve/CVE-2017-9373
https://access.redhat.com/security/cve/CVE-2017-9374
https://access.redhat.com/security/cve/CVE-2017-9375
https://access.redhat.com/security/cve/CVE-2017-9524
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZgQyYXlSAg2UNWIIRAlrpAJ953N6QriZuTU4QE/LafQs0irfYeQCfclzF
4hcxhXTcsY5EyEXCyQTAybk=
=S8hH
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

May 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    1 Files
  • 2
    May 2nd
    4 Files
  • 3
    May 3rd
    27 Files
  • 4
    May 4th
    17 Files
  • 5
    May 5th
    3 Files
  • 6
    May 6th
    32 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    0 Files
  • 10
    May 10th
    0 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    0 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    0 Files
  • 17
    May 17th
    0 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close