Issued:
2018-05-21
Updated:
2018-05-21

RHSA-2018:1643 - Security Advisory

Synopsis

Important: qemu-kvm-rhev security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 12.0 (Pike).

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.

Security Fix(es):

  • An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)

Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Affected Products

  • Red Hat OpenStack 12 x86_64
  • Red Hat OpenStack for IBM Power 12 ppc64le

Fixes

  • BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

Red Hat OpenStack 12

SRPM
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm SHA-256: d3764e2f14bbcd422b8a2f9a19f760a8cac07040cbdd2c399d04b283db37b45b
x86_64
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm SHA-256: 2405a8bcdaa9af48b88d2555fb2734eba8699c94ec3f2df1ed45b0d540061fb7
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm SHA-256: adfe966a23f86872cb491320ee4625465e16e129bdc6c6f9bf7bc8c035cb471d
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm SHA-256: e691a92e960057bb82eb6f7741297ea099f8aa4a4443fdb7b3a4b4e256d0fafe
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm SHA-256: 25c338840c595b34fa19b24b5a45d45c212b4185fe93ccf5a83b7db2809c6c5f
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm SHA-256: 320b39e43e466ea06f79fa1bb063d2b110f33ea1724b0db96fdd0eb2170ceee6

Red Hat OpenStack for IBM Power 12

SRPM
ppc64le
qemu-img-rhev-2.10.0-21.el7_5.3.ppc64le.rpm SHA-256: d858c54893e96a3e32e7fee8e4c50b9708c9c67227927325f8dcd5de000775fd
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.ppc64le.rpm SHA-256: 69a72d5645cb0ccd9a6c02dc6b4d347a938c909b20b8af876504748bc42697ff
qemu-kvm-rhev-2.10.0-21.el7_5.3.ppc64le.rpm SHA-256: 1d72046565412aeb3081691570cf5f4b282f1368c10f71fffdd1d65a2ee1d9ef
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.ppc64le.rpm SHA-256: 364552b371e0696e4426f49cb7fcab09fa0514608fbe57bdc396d71f02b569c3
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.ppc64le.rpm SHA-256: 5ba17eecb1048183ab2d2b83f21f240fc0c35c0a9bd8ebe14d653e492620dd56

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.