RHSA-2016:1001 - Security Advisory
Important: qemu-kvm-rhev security update
Security Advisory: Important
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux
OpenStack Platform 7.0 (Kilo) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM in environments
managed by Red Hat Enterprise Virtualization Manager.
- An out-of-bounds read/write access flaw was found in the way QEMU's VGA
emulation with VESA BIOS Extensions (VBE) support performed read/write
operations using I/O port methods. A privileged guest user could use
this flaw to execute arbitrary code on the host with the privileges of the
host's QEMU process. (CVE-2016-3710)
Red Hat would like to thank Wei Xiao (360 Marvel Team) and Qinghao Tang
(360 Marvel Team) for reporting this issue.
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
- Red Hat OpenStack 7 x86_64
- BZ - 1331401 - CVE-2016-3710 qemu: incorrect banked access bounds checking in vga module
Red Hat OpenStack 7