RHSA-2016:2576 - Security Advisory

Topic

An update for libguestfs and virt-p2v is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libguestfs packages contain a library, which is used for accessing and modifying virtual machine (VM) disk images.

Virt-p2v is a tool for conversion of a physical server to a virtual guest.

The following packages have been upgraded to a newer upstream version: libguestfs (1.32.7), virt-p2v (1.32.7). (BZ#1218766)

Security Fix(es):

• An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. (CVE-2015-8869)

Note: The libguestfs packages in this advisory were rebuilt with a fixed version of OCaml to address this issue.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 855058 - RFE: virt-p2v: display more information about storage devices
• BZ - 1064041 - virt-sparsify fails if a btrfs filesystem contains readonly snapshots
• BZ - 1099976 - virt-builder gives GPG warning message with gnupg2
• BZ - 1156298 - Remove files in package libguestfs-bash-completion, these files are bash completion files, some of the virt tool completion are already implement in another file, so can remove its completion file
• BZ - 1164708 - set-label can only set <=127 bytes for btrfs and <=126 bytes for ntfs filesystem which not meet the help message. Also for ntfs it should give a warning message when the length >128 bytes
• BZ - 1166057 - btrfs filesystem will not work well if you create the filesystem with multiple disks at the same time, such as: mkfs-btrfs "/dev/sda1 /dev/sdb1"
• BZ - 1167916 - P2V: invalid conversion server prints unexpected end of file waiting for password prompt.
• BZ - 1173695 - RFE: allow passing in a pre-opened libvirt connection from python
• BZ - 1174551 - "lstatnslist" and "lstatlist" don't give an error if the API is used wrongly
• BZ - 1176801 - File /etc/sysconfig/kernel isn't updated when convert XenPV guest with regular kernel installed
• BZ - 1180769 - Security context on image file gets reset
• BZ - 1190669 - Support virt-v2v conversion of Windows > 7
• BZ - 1213324 - virt-v2v: warning: unknown guest operating system: windows windows 6.3 when converting win8,win8.1,win2012,win2012R2,win10 to rhev
• BZ - 1213701 - Fail to import win8/win2012 to rhev with error "selected display type is not supported"
• BZ - 1218766 - Rebase libguestfs in RHEL 7.3
• BZ - 1225789 - Wrong video driver is installed for rhel5.11 guest after conversion to libvirt
• BZ - 1227599 - P2V invalid password prints unexpected end of file waiting for command prompt.
• BZ - 1227609 - virt-p2v: Using "Back" button causes output list to be repopulated multiple times
• BZ - 1229119 - Unrelated info in fstab makes virt-v2v fail with unclear error info
• BZ - 1229386 - virt-p2v in non-GUI mode doesn't show any conversion progress or status
• BZ - 1238053 - v2v:Duplicate disk target set when convert guest with cdrom attached
• BZ - 1239154 - appliance fails to start with "supermin: ext2fs_file_write: /var/log/tallylog: Could not allocate block in ext2 filesystem"
• BZ - 1242853 - mount-loop failed to setup loop device: No such file or directory
• BZ - 1260801 - virt-builder --ssh-inject doesn't set proper permissions on created files
• BZ - 1261242 - virt-v2v should prevent using '-of' option appears twice on the command line
• BZ - 1261436 - No warning shows when convert a win7 guest with AVG AntiVirus installed
• BZ - 1262959 - virt-builder/virt-customize set password does not work
• BZ - 1264835 - ppc64le: virt-customize --install fail to detect the guest arch
• BZ - 1267032 - guestfish copy-in command behaves oddly/unexpectedly with wildcards
• BZ - 1277074 - Virt-p2v client shouldn't present the vdsm option because it's not usable
• BZ - 1277122 - RFE: virt-sparsify: make '--in-place' sparsification safe to abort (gracefully or ungracefully)
• BZ - 1287826 - Remove virt-v2v support for ppc64le
• BZ - 1290755 - guestfish should be able to handle LVM thin layouts
• BZ - 1292437 - Backport virt-v2v pull dcpath from libvirt <vmware:datacenterpath>
• BZ - 1293527 - There should be a reminder to avoid user to edit a guest image by multiple tools at the same time in guestfish man page
• BZ - 1296606 - virt-v2v doesn't remove VirtualBox additions correctly because of file quoting
• BZ - 1306557 - Running 'git clone' in virt-builder or virt-customize results in an error message
• BZ - 1308769 - virt-v2v does not copy additional disks to Glance
• BZ - 1309580 - OS name of win8.1 x64 guest shows incorrect in rhevm3.6 general info
• BZ - 1309619 - Wrong warning info "use standard VGA" shows when converting windows > 7 by virt-v2v
• BZ - 1309706 - error: internal error: Invalid floppy device name: hdb
• BZ - 1309796 - Filter perl provides
• BZ - 1311373 - Fail to install QXL driver for windows 2008r2 and win7 guest after conversion by virt-v2v
• BZ - 1312254 - virt-v2v -o libvirt doesn't preserve or use correct <graphics type="vnc|spice">
• BZ - 1314244 - RFE: virt-p2v log window should process colour escapes and backspaces
• BZ - 1315237 - Remove reference info about --dcpath in virt-v2v manual page
• BZ - 1316479 - v2v cmd cannot exit and "block I/O error in device 'appliance': No space left on device (28)" is printed when specified "-v -x"
• BZ - 1318440 - virt-sysprep will fail detecting OS if "/usr" is a distinct partition mounted in "/" via fstab
• BZ - 1325825 - virt-v2v should prevent using multiple '-b' and '-n' option appears on the command line
• BZ - 1326266 - virt-v2v should prevent multiple conflicting for "-oa "
• BZ - 1328766 - Remove --in-place option in virt-v2v help
• BZ - 1332025 - Inspection does not parse /etc/redhat-release containing "Derived from Red Hat Enterprise Linux 7.1 (Source)"
• BZ - 1332090 - CVE-2015-8869 ocaml: sizes arguments are sign-extended from 32 to 64 bits
• BZ - 1340407 - Multiple network ports will not be aligned at p2v client
• BZ - 1340464 - [RFE] Suggestion give user a reminder for "Cancel conversion" button
• BZ - 1340809 - Testing connection timeout when input regular user of conversion server with checked "use sudo......"button
• BZ - 1341564 - virt-p2v spinner should be hidden when it stops spinning
• BZ - 1341608 - Ethtool command is not supported on p2v client
• BZ - 1341984 - virt-get-kernel prompts an 'invalid value' error when using --format auto
• BZ - 1342337 - Should remind a warning about disk image has a partition when using virt-p2v-make-disk
• BZ - 1342398 - Convert a guest from RHEL by virt-v2v but its origin info shows RHEV at rhevm
• BZ - 1342447 - Ifconfig command is not supported on p2v client
• BZ - 1343167 - Failure when disk contains an LV with activationskip=y
• BZ - 1343414 - Failed SSH to conversion server by ssh identity http url at p2v client
• BZ - 1343423 - [RFE]Should give a better description about 'curl error 22' when failed using ssh identity http url at p2v client
• BZ - 1345809 - virt-customize --truncate-recursive should give an error message when specifying a no-existing path
• BZ - 1345813 - virt-sysprep --install always failed to install the packages specified
• BZ - 1348900 - virt-p2v should update error prompt when 'Test connection' with a non-existing user in conversion server
• BZ - 1349237 - virt-inspector can not get windows drive letters for GPT disks
• BZ - 1349342 - Error info is not clear when failed ssh to conversion server using non-root user with password on p2v client
• BZ - 1350363 - Improve error info "remote server timeout unexpectedly waiting for password prompt" when connect to a bogus server at p2v client
• BZ - 1352761 - Virt-manager can't show OS icons of win7/win8/ubuntu guest.
• BZ - 1354335 - overlay of disk images does not specify the format of the backing file
• BZ - 1358142 - Some info will show when convert guest to libvirt by virt-v2v with parameter --quiet
• BZ - 1359652 - Fail to inspect Windows ISO file
• BZ - 1362354 - virt-dib failed to create image using DIB_YUM_REPO_CONF
• BZ - 1362357 - run_command runs exit handlers when execve fails (e.g. due to missing executable)
• BZ - 1362668 - Miscellaneous fixes to tool options
• BZ - 1362669 - Backport improved --selinux-relabel support for virt-sysprep, virt-builder, virt-customize
• BZ - 1364347 - virt-sparsify --in-place failed with UEFI system
• BZ - 1364419 - [virt-p2v]Failed to connect to conversion server while testing LSI-mpt2sas hardware which using bnx2x network driver
• BZ - 1365005 - Guest name is incorrect if convert guest from disk image by virt-v2v
• BZ - 1366456 - Converting rhel7 host installed on RAID:warning: fstrim: fstrim: /sysroot/: the discard operation is not supported
• BZ - 1367615 - OVMF file which is built for rhel7.3 can't be used for virt-v2v uefi conversion
• BZ - 1370424 - virt-manager coredump when vm with gluster image exists

CVEs

• CVE-2015-8869

References

• https://access.redhat.com/security/updates/classification/#moderate