[RHSA-2017:2408-01] Moderate: qemu-kvm-rhev security and bug fix update

Tue Aug 1 23:16:21 UTC 2017

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux
OpenStack Platform 6.0 (Juno) for RHEL 7, Red Hat Enterprise Linux
OpenStack Platform 7.0 (Kilo) for RHEL 7, Red Hat OpenStack Platform 8.0
(Liberty), Red Hat OpenStack Platform 9.0 (Mitaka), Red Hat OpenStack
Platform 10.0 (Newton), and Red Hat OpenStack Platform 11.0 (Ocata).

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 - x86_64
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 - x86_64
Red Hat OpenStack Platform 10.0 - x86_64
Red Hat OpenStack Platform 11.0 - x86_64
Red Hat OpenStack Platform 8.0 (Liberty) - x86_64
Red Hat OpenStack Platform 9.0 - x86_64

3. Description:

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.

Security Fix(es):

* Quick Emulator (QEMU) built with Network Block Device (NBD) Server
support was vulnerable to a null-pointer dereference issue. The flaw could
occur when releasing a client that was not initialized due to failed
negotiation. A remote user or process could exploit this flaw to crash the
qemu-nbd server (denial of service). (CVE-2017-9524)

* An information-exposure flaw was found in Quick Emulator (QEMU) in Task
Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw
could occur while accessing TPR. A privileged user inside a guest could use
this issue to read portions of the host memory. (CVE-2016-4020)

* A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB
xHCI controller emulation support. The flaw could occur while doing a
USB-device unplug operation. Unplugging the device repeatedly resulted in
leaking host memory, which affected other services on the host. A
privileged user inside the guest could exploit this flaw to cause a denial
of service on the host or potentially crash the host's QEMU process
instance. (CVE-2016-7466)

* Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0.
(CVE-2016-6888, CVE-2016-7422, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909,
CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922,
CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309,
CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)

Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting
CVE-2016-4020; Li Qiang (Qihoo 360 Inc.) for reporting CVE-2016-6888;
Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team 360.cn
Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting
CVE-2016-7466, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and
CVE-2017-6414; PSIRT (Huawei Inc.) for reporting CVE-2016-8669; Andrew
Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910;
Qinghao Tang (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.)
for reporting CVE-2016-9921 and CVE-2016-9922; Jiang Xin (PSIRT, Huawei
Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang (Qihoo
360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374,
and CVE-2017-9375.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1313686 - CVE-2016-4020 Qemu: i386: leakage of stack memory to guest in kvmvapic.c
1333425 - CVE-2016-8576 Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch
1334398 - CVE-2016-9922 Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy
1369031 - CVE-2016-6888 Qemu: net: vmxnet: integer overflow in packet initialisation
1376755 - CVE-2016-7422 Qemu: virtio: null pointer dereference in virtqueu_map_desc
1377837 - CVE-2016-7466 Qemu: usb: xhci memory leakage during device unplug
1384909 - CVE-2016-8669 Qemu: char: divide by zero error in serial_update_parameters
1388046 - CVE-2016-8910 Qemu: net: rtl8139: infinite loop while transmit in C+ mode
1388052 - CVE-2016-8909 Qemu: audio: intel-hda: infinite loop in processing dma buffer stream
1402265 - CVE-2016-9907 Qemu: usb: redirector: memory leakage when destroying redirector
1402272 - CVE-2016-9911 Qemu: usb: ehci: memory leakage in ehci_init_transfer
1415199 - CVE-2016-10155 Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
1416157 - CVE-2017-5579 Qemu: serial: host memory leakage 16550A UART emulation
1421626 - CVE-2017-5973 Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx
1427833 - CVE-2017-6414 Qemu: libcacard: host memory leakage while creating new APDU
1446517 - CVE-2017-8309 Qemu: audio: host memory leakage via capture buffer
1446547 - CVE-2017-8379 Qemu: input: host memory lekage via keyboard events
1452620 - CVE-2017-9310 Qemu: net: infinite loop in e1000e NIC emulation
1458270 - CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug
1458744 - CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep
1459132 - CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug
1459661 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-11]
1459663 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-6]
1459664 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-7]
1459666 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-8]
1459667 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-9]
1459668 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-10]
1460170 - CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation

6. Package List:

Red Hat OpenStack Platform 10.0:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat OpenStack Platform 11.0:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat OpenStack Platform 8.0 (Liberty):

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

Red Hat OpenStack Platform 9.0:

Source:
qemu-kvm-rhev-2.9.0-10.el7.src.rpm

x86_64:
qemu-img-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-2.9.0-10.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-10.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-10.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-10155
https://access.redhat.com/security/cve/CVE-2016-4020
https://access.redhat.com/security/cve/CVE-2016-6888
https://access.redhat.com/security/cve/CVE-2016-7422
https://access.redhat.com/security/cve/CVE-2016-7466
https://access.redhat.com/security/cve/CVE-2016-8576
https://access.redhat.com/security/cve/CVE-2016-8669
https://access.redhat.com/security/cve/CVE-2016-8909
https://access.redhat.com/security/cve/CVE-2016-8910
https://access.redhat.com/security/cve/CVE-2016-9907
https://access.redhat.com/security/cve/CVE-2016-9911
https://access.redhat.com/security/cve/CVE-2016-9921
https://access.redhat.com/security/cve/CVE-2016-9922
https://access.redhat.com/security/cve/CVE-2017-5579
https://access.redhat.com/security/cve/CVE-2017-5973
https://access.redhat.com/security/cve/CVE-2017-6414
https://access.redhat.com/security/cve/CVE-2017-8309
https://access.redhat.com/security/cve/CVE-2017-8379
https://access.redhat.com/security/cve/CVE-2017-9310
https://access.redhat.com/security/cve/CVE-2017-9373
https://access.redhat.com/security/cve/CVE-2017-9374
https://access.redhat.com/security/cve/CVE-2017-9375
https://access.redhat.com/security/cve/CVE-2017-9524
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZgQyYXlSAg2UNWIIRAlrpAJ953N6QriZuTU4QE/LafQs0irfYeQCfclzF
4hcxhXTcsY5EyEXCyQTAybk=
=S8hH
-----END PGP SIGNATURE-----