-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: qemu-kvm security, bug fix, and enhancement update Advisory ID: RHSA-2022:7967-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:7967 Issue date: 2022-11-15 CVE Names: CVE-2021-3507 CVE-2021-3611 CVE-2021-3750 CVE-2021-4158 ==================================================================== 1. Summary: An update for qemu-kvm is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64 3. Description: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. The following packages have been upgraded to a later upstream version: qemu-kvm (7.0.0). (BZ#2064757) Security Fix(es): * QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free (CVE-2021-3750) * QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507) * QEMU: intel-hda: segmentation fault due to stack overflow (CVE-2021-3611) * QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1477099 - virtio-iommu (including ACPI, VHOST/VFIO integration, migration support) 1708300 - RFE: qemu-nbd vs NBD_FLAG_CAN_MULTI_CONN 1879437 - Qemu coredump when refreshing block limits on an actively used iothread block device [rhel.9] 1904267 - Q35: Support SMBIOS 3.0 Entry Point Type 1951118 - CVE-2021-3507 QEMU: fdc: heap buffer overflow in DMA read data transfers 1968509 - Use MSG_ZEROCOPY on QEMU Live Migration 1973784 - CVE-2021-3611 QEMU: intel-hda: segmentation fault due to stack overflow 1982600 - qemu-kvm -help reports -spice despite not being compiled 1995710 - RFE: Allow virtio-scsi CD-ROM media change with IOThreads 1999073 - CVE-2021-3750 QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free 2020993 - 'qemu-img convert' to Qcow2 Images over RBD Failed 2023977 - Duplicate SMBIOS handles when creating large VMs 2026955 - RFE: set default resolution/EDID info to a more sensible modern size like 1280x800 (WXGA) 2035002 - CVE-2021-4158 QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c 2037612 - [Win11][tpm][QL41112 PF] vfio_listener_region_add received unaligned region 2041823 - [aarch64][numa] When there are at least 6 Numa nodes serial log shows 'arch topology borken' 2044162 - [RHEL9.1] Enable virtio-mem as tech-preview on ARM64 QEMU 2046029 - [WRB] New machine type property - dtb-kaslr-seed 2060839 - Consider deprecating CPU models like "kvm64" / "qemu64" on RHEL 9 2062809 - Guest can not start with SLIC acpi table [rhel-9.1.0] 2062813 - Mark all RHEL-8 and earlier machine types as deprecated [rhel-9.1.0] 2062817 - Missing qemu-kvm-block-ssh obsolete breaks upgrade path [rhel-9.1.0] 2062819 - Broken upgrade path due to qemu-kvm-hw-usbredir rename [rhel-9.1.0] 2062828 - [virtual network][rhel9][vDPA] qemu crash after hot unplug vdpa device [rhel-9.1.0] 2064500 - Install qemu-kvm-6.2.0-11.el9_0.1 failed as conflict with qemu-kvm-block-ssh-6.2.0-11.el9_0.1 2064530 - Rebuild qemu-kvm with clang-14 2064757 - Rebase to QEMU 7.0.0 2064771 - Update machine type compatibility for QEMU 7.0.0 update [x86_64] 2064782 - Update machine type compatibility for QEMU 7.0.0 update [s390x] 2065398 - watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [cat:2843] [rhel-9.1.0] 2066824 - Aarch64: Drop unsupported CPU types 2070804 - PXE boot crash qemu when using multiqueue vDPA 2072379 - Fail to rebuild the reference count tables of qcow2 image on host block devices (e.g. LVs) 2079347 - Guest boot blocked when scsi disks using same iothread and 100% CPU consumption 2079938 - qemu coredump when boot with multi disks (qemu) failed to set up stack guard page: Cannot allocate memory 2081022 - Build regression on ppc64le with c9s qemu-kvm 7.0.0-1 changes 2086262 - [Win11][tpm]vfio_listener_region_del received unaligned region 2094252 - Compile the virtio-iommu device on x86_64 2094270 - Do not set the hard vCPU limit to the soft vCPU limit in downstream qemu-kvm anymore 2095608 - Please correct the error message when try to start qemu with "-M kernel-irqchip=split" 2096143 - The migration port is not released if use it again for recovering postcopy migration 2099541 - qemu coredump with error Assertion `qemu_mutex_iothread_locked()' failed when repeatly hotplug/unplug disks in pause status 2099934 - Guest reboot on destination host after postcopy migration completed 2100106 - Fix virtio-iommu/vfio bypass 2107466 - zerocopy capability can be enabled when set migrate capabilities with multifd and compress/xbzrle together 2111994 - RHEL9: skey test in kvm_unit_test got failed 2112303 - virtio-blk: Can't boot fresh installation from used 512 cluster_size image under certain conditions 2114060 - vDPA state restore support through control virtqueue in Qemu 2116876 - Fixes for vDPA control virtqueue support in Qemu 2120275 - Wrong max_sectors_kb and Maximum transfer length on the pass-through device [rhel-9.1] 6. Package List: Red Hat Enterprise Linux AppStream (v. 9): Source: qemu-kvm-7.0.0-13.el9.src.rpm aarch64: qemu-guest-agent-7.0.0-13.el9.aarch64.rpm qemu-guest-agent-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-img-7.0.0-13.el9.aarch64.rpm qemu-img-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-7.0.0-13.el9.aarch64.rpm qemu-kvm-audio-pa-7.0.0-13.el9.aarch64.rpm qemu-kvm-audio-pa-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-block-curl-7.0.0-13.el9.aarch64.rpm qemu-kvm-block-curl-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-block-rbd-7.0.0-13.el9.aarch64.rpm qemu-kvm-block-rbd-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-common-7.0.0-13.el9.aarch64.rpm qemu-kvm-common-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-core-7.0.0-13.el9.aarch64.rpm qemu-kvm-core-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-debugsource-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-gl-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-gl-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-gl-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-gl-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-usb-host-7.0.0-13.el9.aarch64.rpm qemu-kvm-device-usb-host-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-docs-7.0.0-13.el9.aarch64.rpm qemu-kvm-tests-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-kvm-tools-7.0.0-13.el9.aarch64.rpm qemu-kvm-tools-debuginfo-7.0.0-13.el9.aarch64.rpm qemu-pr-helper-7.0.0-13.el9.aarch64.rpm qemu-pr-helper-debuginfo-7.0.0-13.el9.aarch64.rpm ppc64le: qemu-guest-agent-7.0.0-13.el9.ppc64le.rpm qemu-guest-agent-debuginfo-7.0.0-13.el9.ppc64le.rpm qemu-img-7.0.0-13.el9.ppc64le.rpm qemu-img-debuginfo-7.0.0-13.el9.ppc64le.rpm qemu-kvm-debuginfo-7.0.0-13.el9.ppc64le.rpm qemu-kvm-debugsource-7.0.0-13.el9.ppc64le.rpm s390x: qemu-guest-agent-7.0.0-13.el9.s390x.rpm qemu-guest-agent-debuginfo-7.0.0-13.el9.s390x.rpm qemu-img-7.0.0-13.el9.s390x.rpm qemu-img-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-7.0.0-13.el9.s390x.rpm qemu-kvm-audio-pa-7.0.0-13.el9.s390x.rpm qemu-kvm-audio-pa-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-block-curl-7.0.0-13.el9.s390x.rpm qemu-kvm-block-curl-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-block-rbd-7.0.0-13.el9.s390x.rpm qemu-kvm-block-rbd-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-common-7.0.0-13.el9.s390x.rpm qemu-kvm-common-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-core-7.0.0-13.el9.s390x.rpm qemu-kvm-core-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-debugsource-7.0.0-13.el9.s390x.rpm qemu-kvm-device-display-virtio-gpu-7.0.0-13.el9.s390x.rpm qemu-kvm-device-display-virtio-gpu-ccw-7.0.0-13.el9.s390x.rpm qemu-kvm-device-display-virtio-gpu-ccw-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-device-display-virtio-gpu-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-device-display-virtio-gpu-gl-7.0.0-13.el9.s390x.rpm qemu-kvm-device-display-virtio-gpu-gl-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-device-usb-host-7.0.0-13.el9.s390x.rpm qemu-kvm-device-usb-host-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-docs-7.0.0-13.el9.s390x.rpm qemu-kvm-tests-debuginfo-7.0.0-13.el9.s390x.rpm qemu-kvm-tools-7.0.0-13.el9.s390x.rpm qemu-kvm-tools-debuginfo-7.0.0-13.el9.s390x.rpm qemu-pr-helper-7.0.0-13.el9.s390x.rpm qemu-pr-helper-debuginfo-7.0.0-13.el9.s390x.rpm x86_64: qemu-guest-agent-7.0.0-13.el9.x86_64.rpm qemu-guest-agent-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-img-7.0.0-13.el9.x86_64.rpm qemu-img-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-7.0.0-13.el9.x86_64.rpm qemu-kvm-audio-pa-7.0.0-13.el9.x86_64.rpm qemu-kvm-audio-pa-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-block-curl-7.0.0-13.el9.x86_64.rpm qemu-kvm-block-curl-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-block-rbd-7.0.0-13.el9.x86_64.rpm qemu-kvm-block-rbd-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-common-7.0.0-13.el9.x86_64.rpm qemu-kvm-common-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-core-7.0.0-13.el9.x86_64.rpm qemu-kvm-core-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-debugsource-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-gl-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-gl-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-pci-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-pci-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-pci-gl-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-gpu-pci-gl-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-vga-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-vga-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-vga-gl-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-display-virtio-vga-gl-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-usb-host-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-usb-host-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-usb-redirect-7.0.0-13.el9.x86_64.rpm qemu-kvm-device-usb-redirect-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-docs-7.0.0-13.el9.x86_64.rpm qemu-kvm-tests-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-tools-7.0.0-13.el9.x86_64.rpm qemu-kvm-tools-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-ui-egl-headless-7.0.0-13.el9.x86_64.rpm qemu-kvm-ui-egl-headless-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-kvm-ui-opengl-7.0.0-13.el9.x86_64.rpm qemu-kvm-ui-opengl-debuginfo-7.0.0-13.el9.x86_64.rpm qemu-pr-helper-7.0.0-13.el9.x86_64.rpm qemu-pr-helper-debuginfo-7.0.0-13.el9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3507 https://access.redhat.com/security/cve/CVE-2021-3611 https://access.redhat.com/security/cve/CVE-2021-3750 https://access.redhat.com/security/cve/CVE-2021-4158 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY3OMhtzjgjWX9erEAQiSNw/+PECa4knr835Ovk54z9SclIiHdzc6yQk6 XOF3+t2hJtomewv83jwJP4mXI3IASX+FlEiZSA3R9iBz6rw/4m3VlwDHQO3Udfdy 6x5drqg1DQXo1WwyNvUuPncW8c9G/b7gEG85WnT2dRFUn+qN3RYgJzxhPgviyOTh 1PBw4RVHTOHOR9y8FMFMfVO5doWtlh1GfiaOVGRfTNMNWe76ldd5AFOa3Fez1MRl odAzuXVVXpnXx0zgYgxvu2mxCTSs0FkBZ/6Se1YHAx0YOKd311SU+EGDs5Xsl6vf 2TSrzN9JchmiS111fVWyATdMcKqUvwInAZNgm0NpTQZof+yeY7fxSXvlkZzUXrq7 8tCjTx4KR9FIj76gm1j2lL1OC8td083RFtiG9G69QJOgeIM2m1psPmRNwGo+/iS6 bK2W5cX5zuJvUJ0DvREY1L3CThxRYBfzBRwTDEHVNPbvXIrgU2h/yb7bwt1DaG2X 5poyHsbsHjW/oD1Shi4AP5PW3yJw6Mu+RhxOXFZC88bRw6wV6VhMuxuU1/DJ2W10 42kMgZHEQCMFKVK4E5rzog2iWHYToccPC0T4OYwFJA/DqY8E4HoWslraLAifPOxC wvjd50nu3/DjmF+5NHplVh9z65BQk/cEpnrTdjD0he3W0YynhfC1sD/+aLxChQ/D B1Vp/1EISs0=LjZY -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce