Issued:
2019-07-02
Updated:
2019-07-02

RHSA-2019:1650 - Security Advisory

Synopsis

Low: qemu-kvm security update

Type/Severity

Security Advisory: Low

Topic

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

  • QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux Server 6 x86_64
  • Red Hat Enterprise Linux Server 6 i386
  • Red Hat Enterprise Linux Workstation 6 x86_64
  • Red Hat Enterprise Linux Workstation 6 i386
  • Red Hat Enterprise Linux Desktop 6 x86_64
  • Red Hat Enterprise Linux Desktop 6 i386
  • Red Hat Enterprise Linux for Power, big endian 6 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

  • BZ - 1678515 - CVE-2019-9824 QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables

CVEs

References

Red Hat Enterprise Linux Server 6

SRPM
qemu-kvm-0.12.1.2-2.506.el6_10.4.src.rpm SHA-256: 0ee341ba8de7a45d8178afda3a4449535d306df8a27a74360ba8b5ca40f1d955
x86_64
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: a7cab560f27cfd50541ca673bbac677bc1d121674c30dff00d096cd7dc127e06
qemu-img-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 4a1773acda22045dbc1eac7ff7c7c89155a1b091a42318fd1032800b100e7320
qemu-kvm-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 6c308c181b89930f9a6da2c1ba702fd97feb76e84038407f74d5145cd7ef265a
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: c916235097b2aede879a206866bff053b5206a02f42dd159f3026166b14cc9a8
qemu-kvm-tools-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 26e733855b437067a11731d95acf02d91c22ebe1934c417473cf856be6b751f7
i386
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.i686.rpm SHA-256: 3740b17d9668f314a55edc5ffb86434a2b6de3440608ce68b1407ee0633e26f6
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.i686.rpm SHA-256: 0e063ac786ce558e0a287cb5de83aea53ddf806f57f40878d74a226220980344

Red Hat Enterprise Linux Workstation 6

SRPM
qemu-kvm-0.12.1.2-2.506.el6_10.4.src.rpm SHA-256: 0ee341ba8de7a45d8178afda3a4449535d306df8a27a74360ba8b5ca40f1d955
x86_64
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: a7cab560f27cfd50541ca673bbac677bc1d121674c30dff00d096cd7dc127e06
qemu-img-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 4a1773acda22045dbc1eac7ff7c7c89155a1b091a42318fd1032800b100e7320
qemu-kvm-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 6c308c181b89930f9a6da2c1ba702fd97feb76e84038407f74d5145cd7ef265a
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: c916235097b2aede879a206866bff053b5206a02f42dd159f3026166b14cc9a8
qemu-kvm-tools-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 26e733855b437067a11731d95acf02d91c22ebe1934c417473cf856be6b751f7
i386
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.i686.rpm SHA-256: 3740b17d9668f314a55edc5ffb86434a2b6de3440608ce68b1407ee0633e26f6
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.i686.rpm SHA-256: 0e063ac786ce558e0a287cb5de83aea53ddf806f57f40878d74a226220980344

Red Hat Enterprise Linux Desktop 6

SRPM
qemu-kvm-0.12.1.2-2.506.el6_10.4.src.rpm SHA-256: 0ee341ba8de7a45d8178afda3a4449535d306df8a27a74360ba8b5ca40f1d955
x86_64
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: a7cab560f27cfd50541ca673bbac677bc1d121674c30dff00d096cd7dc127e06
qemu-img-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 4a1773acda22045dbc1eac7ff7c7c89155a1b091a42318fd1032800b100e7320
qemu-kvm-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 6c308c181b89930f9a6da2c1ba702fd97feb76e84038407f74d5145cd7ef265a
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: c916235097b2aede879a206866bff053b5206a02f42dd159f3026166b14cc9a8
qemu-kvm-tools-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 26e733855b437067a11731d95acf02d91c22ebe1934c417473cf856be6b751f7
i386
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.i686.rpm SHA-256: 3740b17d9668f314a55edc5ffb86434a2b6de3440608ce68b1407ee0633e26f6
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.i686.rpm SHA-256: 0e063ac786ce558e0a287cb5de83aea53ddf806f57f40878d74a226220980344

Red Hat Enterprise Linux for Power, big endian 6

SRPM
qemu-kvm-0.12.1.2-2.506.el6_10.4.src.rpm SHA-256: 0ee341ba8de7a45d8178afda3a4449535d306df8a27a74360ba8b5ca40f1d955
ppc64
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.ppc64.rpm SHA-256: fbc56b49c3481e7147b4902914536ca07dcc34f97a1da5ffe1fbea20a26c58bb
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.ppc64.rpm SHA-256: 922468cf849a10882c71e8e9f2a77442f7c365ee610f598dfda6fac481c85ccf

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
qemu-kvm-0.12.1.2-2.506.el6_10.4.src.rpm SHA-256: 0ee341ba8de7a45d8178afda3a4449535d306df8a27a74360ba8b5ca40f1d955
x86_64
qemu-guest-agent-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: a7cab560f27cfd50541ca673bbac677bc1d121674c30dff00d096cd7dc127e06
qemu-img-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 4a1773acda22045dbc1eac7ff7c7c89155a1b091a42318fd1032800b100e7320
qemu-kvm-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 6c308c181b89930f9a6da2c1ba702fd97feb76e84038407f74d5145cd7ef265a
qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: c916235097b2aede879a206866bff053b5206a02f42dd159f3026166b14cc9a8
qemu-kvm-tools-0.12.1.2-2.506.el6_10.4.x86_64.rpm SHA-256: 26e733855b437067a11731d95acf02d91c22ebe1934c417473cf856be6b751f7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.