Synopsis

Important: libvirt security update

Type/Severity

Security Advisory: Important

Topic

An update for libvirt is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

• An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)
  

Note: This is the libvirt side of the CVE-2018-3639 mitigation.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, libvirtd will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.4 x86_64

Fixes

• BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

CVEs

• CVE-2018-3639

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/ssbd

Red Hat Enterprise Linux Server - AUS 6.4

SRPM
libvirt-0.10.2-18.el6_4.17.src.rpm	SHA-256: 2da08f856831ec496672a81cc2f7d178f594c39e2a14a37c103696780d8a7bd5
x86_64
libvirt-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: 85d55d135758d030e1dae66f58bb978af555c6756cca59f9091a9c4499bba55a
libvirt-client-0.10.2-18.el6_4.17.i686.rpm	SHA-256: 97d3bba344d8220a660be62c30d60a3526a54e5391dccb2da636b737a420f12b
libvirt-client-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: 206588ec8174ceff6b09b3cc155afc3eb2a49805ec483d7b68c4e223a25e6bba
libvirt-debuginfo-0.10.2-18.el6_4.17.i686.rpm	SHA-256: 71d06a13848e9124a058c05d719f789a1ab191631131ad5c50edda1b6aa5729d
libvirt-debuginfo-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: 7cf15e24e21917ca5bfa3d21cdc1e0e76409b7e6e7f3a2c4801b62a088a6944f
libvirt-debuginfo-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: 7cf15e24e21917ca5bfa3d21cdc1e0e76409b7e6e7f3a2c4801b62a088a6944f
libvirt-devel-0.10.2-18.el6_4.17.i686.rpm	SHA-256: 81860db78df87f1685b062bf5093c812815ca10a543ca47c6e821c379591e720
libvirt-devel-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: 1fa21001af3a4e9d1e4496e9709bd5ac490acd2434b062c7bfa779c5d7f76a01
libvirt-lock-sanlock-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: cfe1d5d3717c0a334e62936b7b55c3c1ed8e4cb119d0908da3939959cb3061e4
libvirt-python-0.10.2-18.el6_4.17.x86_64.rpm	SHA-256: 8956ec0b283a34a35ae4d91d1e9ee0371b8dd126feb87596e7bd38dd1a53334f