-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: qemu-kvm-rhev security and bug fix update Advisory ID: RHSA-2017:2408-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2017:2408 Issue date: 2017-08-01 CVE Names: CVE-2016-10155 CVE-2016-4020 CVE-2016-6888 CVE-2016-7422 CVE-2016-7466 CVE-2016-8576 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9907 CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 CVE-2017-5579 CVE-2017-5973 CVE-2017-6414 CVE-2017-8309 CVE-2017-8379 CVE-2017-9310 CVE-2017-9373 CVE-2017-9374 CVE-2017-9375 CVE-2017-9524 ===================================================================== 1. Summary: An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7, Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7, Red Hat OpenStack Platform 8.0 (Liberty), Red Hat OpenStack Platform 9.0 (Mitaka), Red Hat OpenStack Platform 10.0 (Newton), and Red Hat OpenStack Platform 11.0 (Ocata). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 - x86_64 Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 - x86_64 Red Hat OpenStack Platform 10.0 - x86_64 Red Hat OpenStack Platform 11.0 - x86_64 Red Hat OpenStack Platform 8.0 (Liberty) - x86_64 Red Hat OpenStack Platform 9.0 - x86_64 3. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix(es): * Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial of service). (CVE-2017-9524) * An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory. (CVE-2016-4020) * A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance. (CVE-2016-7466) * Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0. (CVE-2016-6888, CVE-2016-7422, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375) Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting CVE-2016-4020; Li Qiang (Qihoo 360 Inc.) for reporting CVE-2016-6888; Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team 360.cn Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting CVE-2016-7466, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and CVE-2017-6414; PSIRT (Huawei Inc.) for reporting CVE-2016-8669; Andrew Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910; Qinghao Tang (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.) for reporting CVE-2016-9921 and CVE-2016-9922; Jiang Xin (PSIRT, Huawei Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, and CVE-2017-9375. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1313686 - CVE-2016-4020 Qemu: i386: leakage of stack memory to guest in kvmvapic.c 1333425 - CVE-2016-8576 Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch 1334398 - CVE-2016-9922 Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy 1369031 - CVE-2016-6888 Qemu: net: vmxnet: integer overflow in packet initialisation 1376755 - CVE-2016-7422 Qemu: virtio: null pointer dereference in virtqueu_map_desc 1377837 - CVE-2016-7466 Qemu: usb: xhci memory leakage during device unplug 1384909 - CVE-2016-8669 Qemu: char: divide by zero error in serial_update_parameters 1388046 - CVE-2016-8910 Qemu: net: rtl8139: infinite loop while transmit in C+ mode 1388052 - CVE-2016-8909 Qemu: audio: intel-hda: infinite loop in processing dma buffer stream 1402265 - CVE-2016-9907 Qemu: usb: redirector: memory leakage when destroying redirector 1402272 - CVE-2016-9911 Qemu: usb: ehci: memory leakage in ehci_init_transfer 1415199 - CVE-2016-10155 Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb 1416157 - CVE-2017-5579 Qemu: serial: host memory leakage 16550A UART emulation 1421626 - CVE-2017-5973 Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx 1427833 - CVE-2017-6414 Qemu: libcacard: host memory leakage while creating new APDU 1446517 - CVE-2017-8309 Qemu: audio: host memory leakage via capture buffer 1446547 - CVE-2017-8379 Qemu: input: host memory lekage via keyboard events 1452620 - CVE-2017-9310 Qemu: net: infinite loop in e1000e NIC emulation 1458270 - CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug 1458744 - CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep 1459132 - CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug 1459661 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-11] 1459663 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-6] 1459664 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-7] 1459666 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-8] 1459667 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-9] 1459668 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-10] 1460170 - CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation 6. Package List: Red Hat OpenStack Platform 10.0: Source: qemu-kvm-rhev-2.9.0-10.el7.src.rpm x86_64: qemu-img-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm Red Hat OpenStack Platform 11.0: Source: qemu-kvm-rhev-2.9.0-10.el7.src.rpm x86_64: qemu-img-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7: Source: qemu-kvm-rhev-2.9.0-10.el7.src.rpm x86_64: qemu-img-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7: Source: qemu-kvm-rhev-2.9.0-10.el7.src.rpm x86_64: qemu-img-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm Red Hat OpenStack Platform 8.0 (Liberty): Source: qemu-kvm-rhev-2.9.0-10.el7.src.rpm x86_64: qemu-img-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm Red Hat OpenStack Platform 9.0: Source: qemu-kvm-rhev-2.9.0-10.el7.src.rpm x86_64: qemu-img-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-10155 https://access.redhat.com/security/cve/CVE-2016-4020 https://access.redhat.com/security/cve/CVE-2016-6888 https://access.redhat.com/security/cve/CVE-2016-7422 https://access.redhat.com/security/cve/CVE-2016-7466 https://access.redhat.com/security/cve/CVE-2016-8576 https://access.redhat.com/security/cve/CVE-2016-8669 https://access.redhat.com/security/cve/CVE-2016-8909 https://access.redhat.com/security/cve/CVE-2016-8910 https://access.redhat.com/security/cve/CVE-2016-9907 https://access.redhat.com/security/cve/CVE-2016-9911 https://access.redhat.com/security/cve/CVE-2016-9921 https://access.redhat.com/security/cve/CVE-2016-9922 https://access.redhat.com/security/cve/CVE-2017-5579 https://access.redhat.com/security/cve/CVE-2017-5973 https://access.redhat.com/security/cve/CVE-2017-6414 https://access.redhat.com/security/cve/CVE-2017-8309 https://access.redhat.com/security/cve/CVE-2017-8379 https://access.redhat.com/security/cve/CVE-2017-9310 https://access.redhat.com/security/cve/CVE-2017-9373 https://access.redhat.com/security/cve/CVE-2017-9374 https://access.redhat.com/security/cve/CVE-2017-9375 https://access.redhat.com/security/cve/CVE-2017-9524 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZgQyYXlSAg2UNWIIRAlrpAJ953N6QriZuTU4QE/LafQs0irfYeQCfclzF 4hcxhXTcsY5EyEXCyQTAybk= =S8hH -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce