RHSA-2017:0351 - Security Advisory
Important: qemu-kvm-rhev security update
Security Advisory: Important
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
- Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
For details on how to apply this update, which includes the changes described in this advisory, refer to:
After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
- Red Hat Virtualization 3 for RHEL 6 x86_64
- BZ - 1420484 - CVE-2017-2620 Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo
Red Hat Virtualization 3 for RHEL 6