[RHSA-2016:2670-01] Moderate: qemu-kvm-rhev security, bug fix, and enhancement update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: qemu-kvm-rhev security, bug fix, and enhancement update

Advisory ID: RHSA-2016:2670-01

Product: Red Hat Enterprise Linux OpenStack Platform

Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2670.html

Issue date: 2016-11-07

CVE Names: CVE-2015-8817 CVE-2015-8818

=====================================================================

 

1. Summary:

 

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform

8.0 (Liberty).

 

Red Hat Product Security has rated this update as having a security impact

of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

gives a detailed severity rating, is available for each vulnerability from

the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat OpenStack Platform 8.0 (Liberty) - x86_64

 

3. Description:

 

KVM (Kernel-based Virtual Machine) is a full virtualization solution for

Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the

user-space component for running virtual machines using KVM in environments

managed by Red Hat Enterprise Virtualization Manager.

 

The following packages have been upgraded to a newer upstream version:

qemu-kvm-rhev (2.6.0). (BZ#1386383)

 

Security Fix(es):

 

* An out-of-bounds flaw was found in the QEMU emulator built using

'address_space_translate' to map an address to a MemoryRegionSection. The

flaw could occur while doing pci_dma_read/write calls, resulting in an

out-of-bounds read-write access error. A privileged user inside a guest

could use this flaw to crash the guest instance (denial of service).

(CVE-2015-8817, CVE-2015-8818)

 

Red Hat would like to thank Donghai Zdh of Alibaba Inc. for reporting this

issue.

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

After installing this update, shut down all running virtual machines. Once

all virtual machines have shut down, start them again for this update to

take effect.

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1300771 - CVE-2015-8817 CVE-2015-8818 Qemu: OOB access in address_space_rw leads to segmentation fault

1374366 - RHSA-2016-1756 breaks migration of instances [OSP8]

1386383 - Rebase qemu-kvm-rhev to 2.6.0

 

6. Package List:

 

Red Hat OpenStack Platform 8.0 (Liberty):

 

Source:

qemu-kvm-rhev-2.6.0-27.el7.src.rpm

 

x86_64:

qemu-img-rhev-2.6.0-27.el7.x86_64.rpm

qemu-kvm-common-rhev-2.6.0-27.el7.x86_64.rpm

qemu-kvm-rhev-2.6.0-27.el7.x86_64.rpm

qemu-kvm-rhev-debuginfo-2.6.0-27.el7.x86_64.rpm

qemu-kvm-tools-rhev-2.6.0-27.el7.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2015-8817

https://access.redhat.com/security/cve/CVE-2015-8818

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2016 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFYIM7eXlSAg2UNWIIRAhVlAKCHfuK0S0pYpv0a2JAbxSimClIVMgCgsOuV

gJMxK0UrLeboA7zOv6ihDtc=

=zyZk

-----END PGP SIGNATURE-----

 

 

--