- Issued:
- 2016-09-27
- Updated:
- 2016-09-27
RHSA-2016:1943 - Security Advisory
Synopsis
Important: kvm security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
Topic
An update for kvm is now available for Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
Description
KVM (for Kernel-based Virtual Machine) is a full virtualization solution for
Linux on x86 hardware. Using KVM, one can run multiple virtual machines running
unmodified Linux or Windows images. Each virtual machine has private virtualized
hardware: a network card, disk, graphics adapter, etc.
Security Fix(es):
- An out-of-bounds read/write access flaw was found in the way QEMU's VGA
emulation with VESA BIOS Extensions (VBE) support performed read/write
operations using I/O port methods. A privileged guest user could use this flaw
to execute arbitrary code on the host with the privileges of the host's QEMU
process. (CVE-2016-3710)
- Quick Emulator(QEMU) built with the virtio framework is vulnerable to an
unbounded memory allocation issue. It was found that a malicious guest user
could submit more requests than the virtqueue size permits. Processing a request
allocates a VirtQueueElement results in unbounded memory allocation on the host
controlled by the guest. (CVE-2016-5403)
Red Hat would like to thank Wei Xiao (360 Marvel Team) and Qinghao Tang (360
Marvel Team) for reporting CVE-2016-3710 and hongzhenhao (Marvel Team) for
reporting CVE-2016-5403.
Solution
For details on how to apply this update, which includes the changes described in
this advisory, refer to:
https://access.redhat.com/articles/11258
Note: The procedure in the Solution section must be performed before this update
will take effect.
Affected Products
- Red Hat Enterprise Linux Server 5 x86_64
- Red Hat Enterprise Linux Workstation 5 x86_64
Fixes
- BZ - 1331401 - CVE-2016-3710 qemu: incorrect banked access bounds checking in vga module
- BZ - 1358359 - CVE-2016-5403 Qemu: virtio: unbounded memory allocation on host via guest leading to DoS
Red Hat Enterprise Linux Server 5
SRPM | |
---|---|
kvm-83-276.el5_11.src.rpm | SHA-256: bee01bdf5d0265082a898780154cfdccacdf5c08a77c1fbcc531f86fc0167bd9 |
x86_64 | |
kmod-kvm-83-276.el5_11.x86_64.rpm | SHA-256: c66d341ccba983fdd9609806746975de54133b6ef8284a8aac343e33219d734a |
kmod-kvm-debug-83-276.el5_11.x86_64.rpm | SHA-256: f8efd16e180a182604754d74f56baa86989c66248dfe9539d1a37c5e03828b80 |
kvm-83-276.el5_11.x86_64.rpm | SHA-256: 0bf2bbdcbe0b8f3dad3533a644eeb3b275087468c1044c46490d5510774108ae |
kvm-debuginfo-83-276.el5_11.x86_64.rpm | SHA-256: 4bef7af13a7f6bba4cc137211d2d50b082ed66dc6373cc1cea10332a464fda31 |
kvm-qemu-img-83-276.el5_11.x86_64.rpm | SHA-256: bef7e25d66d9d2363932a464f7e9d9370bc15dc5f247eee02c49455d7bbb36fe |
kvm-tools-83-276.el5_11.x86_64.rpm | SHA-256: e42334787afae25919b24ddba3228aa032ed5adf6b7e54b6ef07686f8883bc92 |
Red Hat Enterprise Linux Workstation 5
SRPM | |
---|---|
kvm-83-276.el5_11.src.rpm | SHA-256: bee01bdf5d0265082a898780154cfdccacdf5c08a77c1fbcc531f86fc0167bd9 |
x86_64 | |
kmod-kvm-83-276.el5_11.x86_64.rpm | SHA-256: c66d341ccba983fdd9609806746975de54133b6ef8284a8aac343e33219d734a |
kmod-kvm-debug-83-276.el5_11.x86_64.rpm | SHA-256: f8efd16e180a182604754d74f56baa86989c66248dfe9539d1a37c5e03828b80 |
kvm-83-276.el5_11.x86_64.rpm | SHA-256: 0bf2bbdcbe0b8f3dad3533a644eeb3b275087468c1044c46490d5510774108ae |
kvm-debuginfo-83-276.el5_11.x86_64.rpm | SHA-256: 4bef7af13a7f6bba4cc137211d2d50b082ed66dc6373cc1cea10332a464fda31 |
kvm-qemu-img-83-276.el5_11.x86_64.rpm | SHA-256: bef7e25d66d9d2363932a464f7e9d9370bc15dc5f247eee02c49455d7bbb36fe |
kvm-tools-83-276.el5_11.x86_64.rpm | SHA-256: e42334787afae25919b24ddba3228aa032ed5adf6b7e54b6ef07686f8883bc92 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.