Issued:
2018-10-30
Updated:
2018-10-30

RHSA-2018:3400 - Security Advisory

Synopsis

Important: libvirt security update

Type/Severity

Security Advisory: Important

Topic

An update for libvirt is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

  • An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639 virt-ssbd AMD)

Note: This is the libvirt side of the CVE-2018-3639 mitigation.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, libvirtd will be restarted automatically.

Affected Products

  • Red Hat Enterprise Linux Server - AUS 6.6 x86_64
  • Red Hat Enterprise Linux Server - TUS 6.6 x86_64

Fixes

  • BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

CVEs

References

Red Hat Enterprise Linux Server - AUS 6.6

SRPM
libvirt-0.10.2-46.el6_6.9.src.rpm SHA-256: bc04d7d9823630ee120d4a4851064dd5cc2ca3957c8444832d82bf1dd771d268
x86_64
libvirt-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: bfb7173a7f1e512c8292877164996f10a318e45d7a8d7fd4f285c3297a9531fe
libvirt-client-0.10.2-46.el6_6.9.i686.rpm SHA-256: 624f637d824ba068c9f4028fe56efd6dd27a9fa35ace9d6bb4d8ee1a4047b8b3
libvirt-client-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: e5a8cc04a5a2125ead99d9fe71f37b87778e7b0f5dc77a2e40488987e3c559ac
libvirt-debuginfo-0.10.2-46.el6_6.9.i686.rpm SHA-256: 89b01028b2cd6bdace34407b1f8e500281238b439cbbb8b80dd10017707daf52
libvirt-debuginfo-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 7e78a43d610dbae8fb39f34591b6bafe207fa2284589c4943ddccd37f03753b8
libvirt-debuginfo-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 7e78a43d610dbae8fb39f34591b6bafe207fa2284589c4943ddccd37f03753b8
libvirt-devel-0.10.2-46.el6_6.9.i686.rpm SHA-256: 9ee006c5ea2a4cb9f46347dfd8d15204bec41fe19304b4ea2d145685455735fe
libvirt-devel-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 04db1964edcf18420fcc9350a7e3272ba6303e347ebd9fc61f3af77c1416fbb0
libvirt-lock-sanlock-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 5b6cfd18344e759f18ce68600cd7c37d248b7dffdef1c19849fdc06db5695e8e
libvirt-python-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: a90e06ca5c08bdb576bd1541401218d59ef06e96aeabbca506743d45e9322cce

Red Hat Enterprise Linux Server - TUS 6.6

SRPM
libvirt-0.10.2-46.el6_6.9.src.rpm SHA-256: bc04d7d9823630ee120d4a4851064dd5cc2ca3957c8444832d82bf1dd771d268
x86_64
libvirt-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: bfb7173a7f1e512c8292877164996f10a318e45d7a8d7fd4f285c3297a9531fe
libvirt-client-0.10.2-46.el6_6.9.i686.rpm SHA-256: 624f637d824ba068c9f4028fe56efd6dd27a9fa35ace9d6bb4d8ee1a4047b8b3
libvirt-client-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: e5a8cc04a5a2125ead99d9fe71f37b87778e7b0f5dc77a2e40488987e3c559ac
libvirt-debuginfo-0.10.2-46.el6_6.9.i686.rpm SHA-256: 89b01028b2cd6bdace34407b1f8e500281238b439cbbb8b80dd10017707daf52
libvirt-debuginfo-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 7e78a43d610dbae8fb39f34591b6bafe207fa2284589c4943ddccd37f03753b8
libvirt-debuginfo-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 7e78a43d610dbae8fb39f34591b6bafe207fa2284589c4943ddccd37f03753b8
libvirt-devel-0.10.2-46.el6_6.9.i686.rpm SHA-256: 9ee006c5ea2a4cb9f46347dfd8d15204bec41fe19304b4ea2d145685455735fe
libvirt-devel-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 04db1964edcf18420fcc9350a7e3272ba6303e347ebd9fc61f3af77c1416fbb0
libvirt-lock-sanlock-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: 5b6cfd18344e759f18ce68600cd7c37d248b7dffdef1c19849fdc06db5695e8e
libvirt-python-0.10.2-46.el6_6.9.x86_64.rpm SHA-256: a90e06ca5c08bdb576bd1541401218d59ef06e96aeabbca506743d45e9322cce

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.