Issued:
2018-10-30
Updated:
2018-10-30

RHSA-2018:3402 - Security Advisory

Synopsis

Important: libvirt security update

Type/Severity

Security Advisory: Important

Topic

An update for libvirt is now available for Red Hat Enterprise Linux 6.7 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

  • An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639 virt-ssbd AMD)

Note: This is the libvirt side of the CVE-2018-3639 mitigation.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, libvirtd will be restarted automatically.

Affected Products

  • Red Hat Enterprise Linux Server - Extended Update Support 6.7 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 6.7 i386
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.7 s390x
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.7 ppc64
  • Red Hat Enterprise Linux EUS Compute Node 6.7 x86_64

Fixes

  • BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

CVEs

References

Red Hat Enterprise Linux Server - Extended Update Support 6.7

SRPM
libvirt-0.10.2-54.el6_7.9.src.rpm SHA-256: e4498ec73853d88db4e2ad6fccfc6c11f0bead98d702a7d3385f8eba23582e94
x86_64
libvirt-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 7def161e43edf098d2af6273aefa0f50296390ed2e60befdaa7e9e13412fd494
libvirt-client-0.10.2-54.el6_7.9.i686.rpm SHA-256: 43090c36aab64190ff406fca67f15d215655962ab0febbf40684c39a23285d20
libvirt-client-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 9db5d2c67f16a4ac02e0ea2a6abea8940a4b37b8e358a5844072e4ef07152dd2
libvirt-debuginfo-0.10.2-54.el6_7.9.i686.rpm SHA-256: 2e1a1b6e46212c0484c51938324c8a0b66ac8d7d435514fce0d72e7c601051ef
libvirt-debuginfo-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 83352521045338f8886452fae5da0878c78a455d65440e85e6a687e06ef02344
libvirt-debuginfo-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 83352521045338f8886452fae5da0878c78a455d65440e85e6a687e06ef02344
libvirt-devel-0.10.2-54.el6_7.9.i686.rpm SHA-256: cad5b39b70952aabcbafb0472389a75abdc148eac9160dedf9278b851119734a
libvirt-devel-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 16381b5d94f084854d3160ca2b54ee3052689984aacf3fd2ad0c1d408d6075eb
libvirt-lock-sanlock-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 2624e86f95c58e97e2772e99a7875a67f7f669f1063c663af069d7246c9ddb5b
libvirt-python-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 44ac21f8f613c9e1e5c395c5aadaf5474c143f27657818ce3a77e3732be131f5
i386
libvirt-0.10.2-54.el6_7.9.i686.rpm SHA-256: 56796a2925c0b3e8f82942b2b378911fbaa0813bb5ef19965cc80e4a23ccf146
libvirt-client-0.10.2-54.el6_7.9.i686.rpm SHA-256: 43090c36aab64190ff406fca67f15d215655962ab0febbf40684c39a23285d20
libvirt-debuginfo-0.10.2-54.el6_7.9.i686.rpm SHA-256: 2e1a1b6e46212c0484c51938324c8a0b66ac8d7d435514fce0d72e7c601051ef
libvirt-devel-0.10.2-54.el6_7.9.i686.rpm SHA-256: cad5b39b70952aabcbafb0472389a75abdc148eac9160dedf9278b851119734a
libvirt-python-0.10.2-54.el6_7.9.i686.rpm SHA-256: c21f2d18ad9257d00c97bcfb75cfc97fea9f410903e52119e133ddea91b50031

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.7

SRPM
libvirt-0.10.2-54.el6_7.9.src.rpm SHA-256: e4498ec73853d88db4e2ad6fccfc6c11f0bead98d702a7d3385f8eba23582e94
s390x
libvirt-0.10.2-54.el6_7.9.s390x.rpm SHA-256: 797f38ea22e178d4aac4d2df9fced00b122faae1488ed5f7e75f07bb158d0a91
libvirt-client-0.10.2-54.el6_7.9.s390.rpm SHA-256: 530d487090b39049e792afd19bd15fc3d861fb242df18f9097091f93616ce47f
libvirt-client-0.10.2-54.el6_7.9.s390x.rpm SHA-256: 2db257d1d02fbae1fe539e0e330239c7d1d57232c883b517569b4c810a40ecb8
libvirt-debuginfo-0.10.2-54.el6_7.9.s390.rpm SHA-256: 2e74f300f44c29d18fa5087b112f2c6ebdac155c4b0a10adf8889e4bfe49f1d4
libvirt-debuginfo-0.10.2-54.el6_7.9.s390x.rpm SHA-256: 9e3e06027a12a0fcd99f54343047bddc1b2e754ad730f0ad401083660e2eced0
libvirt-devel-0.10.2-54.el6_7.9.s390.rpm SHA-256: 971be18e6b11a494f26d8500ef8690b17959be68290de001833e4b73593f4d41
libvirt-devel-0.10.2-54.el6_7.9.s390x.rpm SHA-256: 07e36b0940fae3d03f7cca41a790cb51b7abb7c12d90ffd8cae8e4c9dd4d9c61
libvirt-python-0.10.2-54.el6_7.9.s390x.rpm SHA-256: a60fed29414b8eaba33810373b0fa52e2715a3587b9cd917660639ef708d912c

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.7

SRPM
libvirt-0.10.2-54.el6_7.9.src.rpm SHA-256: e4498ec73853d88db4e2ad6fccfc6c11f0bead98d702a7d3385f8eba23582e94
ppc64
libvirt-0.10.2-54.el6_7.9.ppc64.rpm SHA-256: 3ddcea227c9694ee2349c1edfc94cfeab6d8dbd6852c76deb40d4934d91bb7f1
libvirt-client-0.10.2-54.el6_7.9.ppc.rpm SHA-256: c6b3a743147cb9127127c262b0ecb7fdbcfe94196a955602d7c2c02950aa78c0
libvirt-client-0.10.2-54.el6_7.9.ppc64.rpm SHA-256: 96a73ecbfb1cac6c973661dab968c3f77492d4f9c215c774bcbba7dddb108522
libvirt-debuginfo-0.10.2-54.el6_7.9.ppc.rpm SHA-256: 4b5fbbb37847f18724ccc7d14a0985dc2b1517dd0bd4a932eb69e2b06ba19136
libvirt-debuginfo-0.10.2-54.el6_7.9.ppc64.rpm SHA-256: 60d2383014badc8d5929a715ed7087ac869929eca89795048ce09300adca56aa
libvirt-devel-0.10.2-54.el6_7.9.ppc.rpm SHA-256: 28aebe24be41301f059ecf50096f14401743ad1df85876ac1c343975a2b0ba00
libvirt-devel-0.10.2-54.el6_7.9.ppc64.rpm SHA-256: a8fcce95be7acc26c55bcffbbcc681577ab10eefc29f1dd12cc490df8f1dc7b6
libvirt-python-0.10.2-54.el6_7.9.ppc64.rpm SHA-256: 543e3e4db7d2534cb0246af918ef7d8fdd7bec1aaee737225f65b05bee734f62

Red Hat Enterprise Linux EUS Compute Node 6.7

SRPM
libvirt-0.10.2-54.el6_7.9.src.rpm SHA-256: e4498ec73853d88db4e2ad6fccfc6c11f0bead98d702a7d3385f8eba23582e94
x86_64
libvirt-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 7def161e43edf098d2af6273aefa0f50296390ed2e60befdaa7e9e13412fd494
libvirt-client-0.10.2-54.el6_7.9.i686.rpm SHA-256: 43090c36aab64190ff406fca67f15d215655962ab0febbf40684c39a23285d20
libvirt-client-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 9db5d2c67f16a4ac02e0ea2a6abea8940a4b37b8e358a5844072e4ef07152dd2
libvirt-debuginfo-0.10.2-54.el6_7.9.i686.rpm SHA-256: 2e1a1b6e46212c0484c51938324c8a0b66ac8d7d435514fce0d72e7c601051ef
libvirt-debuginfo-0.10.2-54.el6_7.9.i686.rpm SHA-256: 2e1a1b6e46212c0484c51938324c8a0b66ac8d7d435514fce0d72e7c601051ef
libvirt-debuginfo-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 83352521045338f8886452fae5da0878c78a455d65440e85e6a687e06ef02344
libvirt-debuginfo-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 83352521045338f8886452fae5da0878c78a455d65440e85e6a687e06ef02344
libvirt-devel-0.10.2-54.el6_7.9.i686.rpm SHA-256: cad5b39b70952aabcbafb0472389a75abdc148eac9160dedf9278b851119734a
libvirt-devel-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 16381b5d94f084854d3160ca2b54ee3052689984aacf3fd2ad0c1d408d6075eb
libvirt-lock-sanlock-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 2624e86f95c58e97e2772e99a7875a67f7f669f1063c663af069d7246c9ddb5b
libvirt-python-0.10.2-54.el6_7.9.x86_64.rpm SHA-256: 44ac21f8f613c9e1e5c395c5aadaf5474c143f27657818ce3a77e3732be131f5

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.