RHSA-2013:1553 - Security Advisory

Topic

Updated qemu-kvm packages that fix one security issue, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems that is built into the standard Red Hat
Enterprise Linux kernel. The qemu-kvm packages form the user-space
component for running virtual machines using KVM.

A buffer overflow flaw was found in the way QEMU processed the SCSI "REPORT
LUNS" command when more than 256 LUNs were specified for a single SCSI
target. A privileged guest user could use this flaw to corrupt QEMU process
memory on the host, which could potentially result in arbitrary code
execution on the host with the privileges of the QEMU process.
(CVE-2013-4344)

This issue was discovered by Asias He of Red Hat.

These updated qemu-kvm packages include numerous bug fixes and various
enhancements. Space precludes documenting all of these changes in this
advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical
Notes, linked to in the References, for information on the most significant
of these changes.

All qemu-kvm users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues and add these
enhancements. After installing this update, shut down all running virtual
machines. Once all virtual machines have shut down, start them again for
this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386

Fixes

• BZ - 670162 - [RFE] Removing the backing file using qemu-img re-base
• BZ - 796011 - Prompt error of trigger blkdebug: BLKDBG_CLUSTER_FREE event is not the same as expected
• BZ - 817066 - QEMU should disable VNC password auth when in FIPS 140-2 mode
• BZ - 821741 - (re-)enable SEP flag on CPU models
• BZ - 843797 - qemu-kvm core dumps when virtio-net(w/ tx=timer and vhost=on) RHEL.6(w/ msi-x enabled) guest shutting down
• BZ - 848070 - [RHEL 6.5] Add glusterfs support to qemu
• BZ - 856505 - Missing error message in bdrv_commit to read-only backing file
• BZ - 864378 - qemu-img convert fails with Floating Point Exception with zero length source image
• BZ - 869496 - screendump wont save PPM image file if qemu-kvm booted with '-S'
• BZ - 869586 - core dump happens when quitting qemu via monitor
• BZ - 879096 - qemu should disable hot-unplug usb-ehci controller and give a prompt if not support
• BZ - 882834 - no warning while check the lacked cpuid_7_0_ebx_feature_name flag
• BZ - 884590 - ovs-ifup affect but ovs-ifdown not affect when run a guest with a wrong netdriver(e.g. ... -device virtio-pci-net,...)
• BZ - 886080 - Qemu segmentation fault when resume VM from stop at rebooting process after do some hot-plug/unplug and S3
• BZ - 886878 - atapi: tray statuses (locked and open) are not reset on boot/reboot of guest
• BZ - 888008 - RFE: qemu-img should be able to report the amount of space used by a qcow2 image stored on a block device
• BZ - 888297 - qemu-ga should be enabled right after installation
• BZ - 889135 - core trace/dump if specify the value of physical_block_size/logical_block_size is not multiple of 512 bytes
• BZ - 889255 - Monitor command acl_remove messes up the ACL
• BZ - 890011 - flooding with 'scsi-generic: execute_command: read failed !' error if eject the pass-through SCSI CD-ROM
• BZ - 890265 - change the mac of virtio_net device temporary but will effect forever after reboot guest
• BZ - 892996 - qemu-ga leaks fds to exec()ed processes [TestOnly]
• BZ - 893344 - "info qtree" output for qxl-vga does not match between rhel6.0 host and rhel6.4 host with -M rhel6.0.0
• BZ - 895399 - Fail to boot win7 guest with x-data-plane=on for the system disk
• BZ - 895402 - Fail to install windows guest with 'Setup was unable to create a new system partiotion or locate an existing system partition' error
• BZ - 902688 - incorrect committed_memory if set_process_name=1
• BZ - 903123 - The value of steal time in "top" command always is "0.0% st" after guest migration
• BZ - 903204 - don't boot from un-selected devices (add a boot option 'strict' to qemu)
• BZ - 903454 - kvm guest crash after long stop/cont cycle
• BZ - 905851 - Fail to start guest which contains more than 51 usbs disk with multifunction
• BZ - 907397 - Patch "e1000: no need auto-negotiation if link was down" may break e1000 guest
• BZ - 907716 - use set_link to change rtl8139 and e1000 network card's status but fail to make effectively after reboot guest
• BZ - 909059 - Switch to upstream solution for chardev flow control
• BZ - 914802 - Support backup vendors in qemu to access qcow disk readonly (qemu-img metadata dump)
• BZ - 917860 - Smartcard emulation with Windows guest fails
• BZ - 924165 - qemu-img convert -s is silently ignored
• BZ - 925170 - MSI routing for 1553 card to guest stops working
• BZ - 927336 - QMP event shows incorrect balloon value when balloon size is grater than or equal to 4G
• BZ - 947416 - fail to specify the serial number for usb storage device
• BZ - 952240 - hot-plugging multi-func devices caused: qemu: hardware error: register_ioport_write: invalid opaque
• BZ - 952873 - [RH Engineering 6.5 FEAT] Synchronize qemu guest agent with upstream
• BZ - 953108 - qemu-img man page still mentions host_device
• BZ - 956929 - /usr/libexec/qemu-kvm was killed by signal 6 (SIGABRT) when SCSI inquiry is sent to unsupported page inside the KVM guest
• BZ - 957319 - Guest w/ vhost=on over virtio-net-pci, under hmp, 'set_link $id_of_netdev off', then migrate, migrate failed, src qemu-kvm process core dumped
• BZ - 961850 - RFE: add -spice disable-agent-file-transfer cmdline option
• BZ - 962669 - Windows guest agent service failed to be started
• BZ - 963420 - [RHEL-6.5] Backport support for vhd(x) image format
• BZ - 963773 - scsi-cd: tray statuses (locked and open) are not reset on boot/reboot of guest
• BZ - 970159 - qemu-kvm-rhevm [race]: vm pauses with 'block I/O error in device '': No medium found (123)' when hounplug a disk and cannot be resumed
• BZ - 970516 - Monitor command acl_add can't insert before last list element
• BZ - 972314 - Every upgrade starts 'ksmd' due to broken initscript 'status' function
• BZ - 974617 - qcow2 corruption bug in cluster allocation code
• BZ - 977760 - fail to boot guest attaching with vmdk format data disk(virito/virtio-scsi interface)
• BZ - 977767 - there is wrong backing file specified for making external snapshot with vmdk format disk
• BZ - 981235 - RFE: Request detail migration statistics output for live migration on RHEL6.5
• BZ - 983635 - QMP: bad input crashes QEMU
• BZ - 985205 - QEMU core dumped when do hot-unplug virtio serial port during transfer file between host to guest with virtio serial through TCP socket
• BZ - 985334 - query mem info from monitor would cause qemu-kvm hang [RHEL-6.5]
• BZ - 987025 - enable MSI-X for virtio-scsi
• BZ - 989585 - crash command can not read the dump-guest-memory file when paging=false [RHEL-6]
• BZ - 990225 - [RHEV/RHEL] Integrate dynamic offloads into virtio-net device
• BZ - 990237 - qemu-kvm exits when hotplugging a cpu with --no-acpi
• BZ - 990316 - QMP: possible memory leaks on commands failure
• BZ - 994374 - boot up guest failed, hung in "booting from hard disk"
• BZ - 994804 - qemu-kvm should verify image header fields before opening VMDK
• BZ - 994891 - duplicate chardev reported after chardev-remove
• BZ - 995341 - hot-unplug chardev with pty backend caused qemu Segmentation fault
• BZ - 995530 - dataplane: refuse to start if device is already in use
• BZ - 996814 - boot image with gluster native mode cant work with attach another device from local file system
• BZ - 996829 - qemu-kvm segmentation fault while boot guest from glusterfs with wrong host name
• BZ - 997220 - Race in gluster_finish_aiocb
• BZ - 999358 - do live migration with used VMDK format disk should fail with a friendly message prompt
• BZ - 999779 - Add vpc file format support in qemu-kvm
• BZ - 999788 - qemu should give a more friendly prompt when didn't specify read-only for VMDK format disk
• BZ - 1002888 - usb hub doesn't work properly (win2012 sees downstream port #1 only)
• BZ - 1003232 - qemu-kvm core dumped when hot plug virtio-serial and transfer character [TestOnly]
• BZ - 1007224 - Introduce bs->zero_beyond_eof
• BZ - 1007330 - CVE-2013-4344 qemu: buffer overflow in scsi_target_emulate_report_luns
• BZ - 1010610 - Backport option "--output=json|human" to qemu-img info command
• BZ - 1013478 - -device usb-storage,serial=... crashes with SCSI generic drive
• BZ - 1016736 - CPU migration data has version_id 12 but version 11 format
• BZ - 1022821 - live-migration from RHEL6.5 to RHEL6.4.z fails with "error while loading state for instance 0x0 of device 'cpu'"

CVEs

• CVE-2013-4344

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/qemu-kvm.html##RHSA-2013-1553