[RHSA-2016:2705-01] Moderate: qemu-kvm-rhev security, bug fix, and enhancement update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: qemu-kvm-rhev security, bug fix, and enhancement update

Advisory ID: RHSA-2016:2705-01

Product: Red Hat Enterprise Linux OpenStack Platform

Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2705.html

Issue date: 2016-11-14

CVE Names: CVE-2015-8817 CVE-2015-8818

=====================================================================

 

1. Summary:

 

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux

OpenStack Platform 6.0 (Juno) for RHEL 7.

 

Red Hat Product Security has rated this update as having a security impact

of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

gives a detailed severity rating, is available for each vulnerability from

the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 - x86_64

 

3. Description:

 

KVM (Kernel-based Virtual Machine) is a full virtualization solution for

Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the

user-space component for running virtual machines using KVM in environments

managed by Red Hat Enterprise Virtualization Manager.

 

The following packages have been upgraded to a newer upstream version:

qemu-kvm-rhev (2.6.0). (BZ#1386379)

 

Security Fix(es):

 

* An out-of-bounds flaw was found in the QEMU emulator built using

'address_space_translate' to map an address to a MemoryRegionSection. The

flaw could occur while doing pci_dma_read/write calls, resulting in an

out-of-bounds read-write access error. A privileged user inside a guest

could use this flaw to crash the guest instance (denial of service).

(CVE-2015-8817, CVE-2015-8818)

 

Red Hat would like to thank Donghai Zdh of Alibaba Inc. for reporting this

issue.

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

After installing this update, shut down all running virtual machines. Once

all virtual machines have shut down, start them again for this update to

take effect.

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1300771 - CVE-2015-8817 CVE-2015-8818 Qemu: OOB access in address_space_rw leads to segmentation fault

1374368 - RHSA-2016-1756 breaks migration of instances [OSP6]

1386379 - Rebase qemu-kvm-rhev to 2.6.0

 

6. Package List:

 

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7:

 

Source:

qemu-kvm-rhev-2.6.0-27.el7.src.rpm

 

x86_64:

qemu-img-rhev-2.6.0-27.el7.x86_64.rpm

qemu-kvm-common-rhev-2.6.0-27.el7.x86_64.rpm

qemu-kvm-rhev-2.6.0-27.el7.x86_64.rpm

qemu-kvm-rhev-debuginfo-2.6.0-27.el7.x86_64.rpm

qemu-kvm-tools-rhev-2.6.0-27.el7.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2015-8817

https://access.redhat.com/security/cve/CVE-2015-8818

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2016 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFYKiC8XlSAg2UNWIIRAr4kAJ9Remx9N4wjGW2mGlK5nsETcsP+NQCcDkNt

+pXlLZuzUOl0dfAI9ea6p48=

=BSaZ

-----END PGP SIGNATURE-----

 

 

--