Jump to content
Compatible Support Forums
Sign in to follow this  
news

[RHSA-2014:0420-01] Moderate: qemu-kvm security update

Recommended Posts

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: qemu-kvm security update

Advisory ID: RHSA-2014:0420-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0420.html

Issue date: 2014-04-22

CVE Names: CVE-2014-0142 CVE-2014-0143 CVE-2014-0144

CVE-2014-0145 CVE-2014-0146 CVE-2014-0147

CVE-2014-0148 CVE-2014-0150

=====================================================================

 

1. Summary:

 

Updated qemu-kvm packages that fix multiple security issues are now

available for Red Hat Enterprise Linux 6.

 

The Red Hat Security Response Team has rated this update as having Moderate

security impact. Common Vulnerability Scoring System (CVSS) base scores,

which give detailed severity ratings, are available for each vulnerability

from the CVE links in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

 

3. Description:

 

KVM (Kernel-based Virtual Machine) is a full virtualization solution for

Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the

user-space component for running virtual machines using KVM.

 

Multiple integer overflow, input validation, logic error, and buffer

overflow flaws were discovered in various QEMU block drivers. An attacker

able to modify a disk image file loaded by a guest could use these flaws to

crash the guest, or corrupt QEMU process memory on the host, potentially

resulting in arbitrary code execution on the host with the privileges of

the QEMU process. (CVE-2014-0143, CVE-2014-0144, CVE-2014-0145,

CVE-2014-0147)

 

A buffer overflow flaw was found in the way the virtio_net_handle_mac()

function of QEMU processed guest requests to update the table of MAC

addresses. A privileged guest user could use this flaw to corrupt QEMU

process memory on the host, potentially resulting in arbitrary code

execution on the host with the privileges of the QEMU process.

(CVE-2014-0150)

 

A divide-by-zero flaw was found in the seek_to_sector() function of the

parallels block driver in QEMU. An attacker able to modify a disk image

file loaded by a guest could use this flaw to crash the guest.

(CVE-2014-0142)

 

A NULL pointer dereference flaw was found in the QCOW2 block driver in

QEMU. An attacker able to modify a disk image file loaded by a guest could

use this flaw to crash the guest. (CVE-2014-0146)

 

It was found that the block driver for Hyper-V VHDX images did not

correctly calculate BAT (Block Allocation Table) entries due to a missing

bounds check. An attacker able to modify a disk image file loaded by a

guest could use this flaw to crash the guest. (CVE-2014-0148)

 

The CVE-2014-0143 issues were discovered by Kevin Wolf and Stefan Hajnoczi

of Red Hat, the CVE-2014-0144 issues were discovered by Fam Zheng, Jeff

Cody, Kevin Wolf, and Stefan Hajnoczi of Red Hat, the CVE-2014-0145 issues

were discovered by Stefan Hajnoczi of Red Hat, the CVE-2014-0150 issue was

discovered by Michael S. Tsirkin of Red Hat, the CVE-2014-0142,

CVE-2014-0146, and CVE-2014-0147 issues were discovered by Kevin Wolf of

Red Hat, and the CVE-2014-0148 issue was discovered by Jeff Cody of

Red Hat.

 

All qemu-kvm users are advised to upgrade to these updated packages, which

contain backported patches to correct these issues. After installing this

update, shut down all running virtual machines. Once all virtual machines

have shut down, start them again for this update to take effect.

 

4. Solution:

 

Before applying this update, make sure all previously released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to

use the Red Hat Network to apply this update are available at

https://access.redhat.com/site/articles/11258

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1078201 - CVE-2014-0142 qemu: crash by possible division by zero

1078212 - CVE-2014-0148 Qemu: vhdx: bounds checking for block_size and logical_sector_size

1078232 - CVE-2014-0146 Qemu: qcow2: NULL dereference in qcow2_open() error path

1078846 - CVE-2014-0150 qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function

1078848 - CVE-2014-0147 Qemu: block: possible crash due signed types or logic error

1078885 - CVE-2014-0145 Qemu: prevent possible buffer overflows

1079140 - CVE-2014-0143 Qemu: block: multiple integer overflow flaws

1079240 - CVE-2014-0144 Qemu: block: missing input validation

 

6. Package List:

 

Red Hat Enterprise Linux Desktop (v. 6):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/qemu-kvm-0.12.1.2-2.415.el6_5.8.src.rpm

 

i386:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.i686.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.i686.rpm

 

x86_64:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-img-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-tools-0.12.1.2-2.415.el6_5.8.x86_64.rpm

 

Red Hat Enterprise Linux HPC Node (v. 6):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/qemu-kvm-0.12.1.2-2.415.el6_5.8.src.rpm

 

x86_64:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-img-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-tools-0.12.1.2-2.415.el6_5.8.x86_64.rpm

 

Red Hat Enterprise Linux Server (v. 6):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/qemu-kvm-0.12.1.2-2.415.el6_5.8.src.rpm

 

i386:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.i686.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.i686.rpm

 

x86_64:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-img-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-tools-0.12.1.2-2.415.el6_5.8.x86_64.rpm

 

Red Hat Enterprise Linux Workstation (v. 6):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/qemu-kvm-0.12.1.2-2.415.el6_5.8.src.rpm

 

i386:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.i686.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.i686.rpm

 

x86_64:

qemu-guest-agent-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-img-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.8.x86_64.rpm

qemu-kvm-tools-0.12.1.2-2.415.el6_5.8.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2014-0142.html

https://www.redhat.com/security/data/cve/CVE-2014-0143.html

https://www.redhat.com/security/data/cve/CVE-2014-0144.html

https://www.redhat.com/security/data/cve/CVE-2014-0145.html

https://www.redhat.com/security/data/cve/CVE-2014-0146.html

https://www.redhat.com/security/data/cve/CVE-2014-0147.html

https://www.redhat.com/security/data/cve/CVE-2014-0148.html

https://www.redhat.com/security/data/cve/CVE-2014-0150.html

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2014 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFTVqwZXlSAg2UNWIIRAn0KAKCwdHEJfaKaIA8QDxKRCbDbj2IKuQCfafQt

07cM07BcjDMYF0Mac08lAto=

=I95P

-----END PGP SIGNATURE-----

 

 

--

 

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×