RHSA-2017:2408 - Security Advisory

Topic

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7, Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7, Red Hat OpenStack Platform 8.0 (Liberty), Red Hat OpenStack Platform 9.0 (Mitaka), Red Hat OpenStack Platform 10.0 (Newton), and Red Hat OpenStack Platform 11.0 (Ocata).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.

Security Fix(es):

• Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial of service). (CVE-2017-9524)
• An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory. (CVE-2016-4020)
• A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance. (CVE-2016-7466)
• Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0. (CVE-2016-6888, CVE-2016-7422, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)

Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting CVE-2016-4020; Li Qiang (Qihoo 360 Inc.) for reporting CVE-2016-6888; Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team 360.cn Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting CVE-2016-7466, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and CVE-2017-6414; PSIRT (Huawei Inc.) for reporting CVE-2016-8669; Andrew Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910; Qinghao Tang (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.) for reporting CVE-2016-9921 and CVE-2016-9922; Jiang Xin (PSIRT, Huawei Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, and CVE-2017-9375.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Affected Products

• Red Hat OpenStack 11 x86_64
• Red Hat OpenStack 10 x86_64
• Red Hat OpenStack 9 x86_64
• Red Hat OpenStack 8 x86_64
• Red Hat OpenStack 7 x86_64
• Red Hat OpenStack 6.0 x86_64

Fixes

• BZ - 1313686 - CVE-2016-4020 Qemu: i386: leakage of stack memory to guest in kvmvapic.c
• BZ - 1333425 - CVE-2016-8576 Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch
• BZ - 1334398 - CVE-2016-9922 Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy
• BZ - 1369031 - CVE-2016-6888 Qemu: net: vmxnet: integer overflow in packet initialisation
• BZ - 1376755 - CVE-2016-7422 Qemu: virtio: null pointer dereference in virtqueu_map_desc
• BZ - 1377837 - CVE-2016-7466 Qemu: usb: xhci memory leakage during device unplug
• BZ - 1384909 - CVE-2016-8669 Qemu: char: divide by zero error in serial_update_parameters
• BZ - 1388046 - CVE-2016-8910 Qemu: net: rtl8139: infinite loop while transmit in C+ mode
• BZ - 1388052 - CVE-2016-8909 Qemu: audio: intel-hda: infinite loop in processing dma buffer stream
• BZ - 1402265 - CVE-2016-9907 Qemu: usb: redirector: memory leakage when destroying redirector
• BZ - 1402272 - CVE-2016-9911 Qemu: usb: ehci: memory leakage in ehci_init_transfer
• BZ - 1415199 - CVE-2016-10155 Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
• BZ - 1416157 - CVE-2017-5579 Qemu: serial: host memory leakage 16550A UART emulation
• BZ - 1421626 - CVE-2017-5973 Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx
• BZ - 1427833 - CVE-2017-6414 Qemu: libcacard: host memory leakage while creating new APDU
• BZ - 1446517 - CVE-2017-8309 Qemu: audio: host memory leakage via capture buffer
• BZ - 1446547 - CVE-2017-8379 Qemu: input: host memory lekage via keyboard events
• BZ - 1452620 - CVE-2017-9310 Qemu: net: infinite loop in e1000e NIC emulation
• BZ - 1458270 - CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug
• BZ - 1458744 - CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep
• BZ - 1459132 - CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug
• BZ - 1459661 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-11]
• BZ - 1459663 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-6]
• BZ - 1459664 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-7]
• BZ - 1459666 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-8]
• BZ - 1459667 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-9]
• BZ - 1459668 - Update qemu-kvm-rhev for RHEL 7.4 compatibility [osp-10]
• BZ - 1460170 - CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation

CVEs

• CVE-2016-10155
• CVE-2016-4020
• CVE-2016-6888
• CVE-2016-7422
• CVE-2016-7466
• CVE-2016-8576
• CVE-2016-8669
• CVE-2016-8909
• CVE-2016-8910
• CVE-2016-9907
• CVE-2016-9911
• CVE-2016-9921
• CVE-2016-9922
• CVE-2017-5579
• CVE-2017-5973
• CVE-2017-6414
• CVE-2017-8309
• CVE-2017-8379
• CVE-2017-9310
• CVE-2017-9373
• CVE-2017-9374
• CVE-2017-9375
• CVE-2017-9524

References

• https://access.redhat.com/security/updates/classification/#moderate