Synopsis

Low: qemu-kvm security, bug fix, and enhancement update

Type/Severity

Security Advisory: Low

Topic

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64

Fixes

• BZ - 1654627 - Qemu: hw: bt: keep bt/* objects from building [rhel-7.7]
• BZ - 1658407 - mode="host-model" VMs include broken "arch-facilities" flag name [qemu-kvm]
• BZ - 1659229 - Ballooning is incompatible with vfio assigned devices, but not prevented
• BZ - 1678515 - CVE-2019-9824 QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables
• BZ - 1686253 - Bitmap merge: Segment fault when merge with a not existed src_name in transaction mode
• BZ - 1709495 - Change CPUID[0x40000000].EAX from 0 to KVM_CPUID_FE...ATURES (0x40000001)

CVEs

• CVE-2019-9824

References

• https://access.redhat.com/security/updates/classification/#low
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index

Red Hat Enterprise Linux Server 7

SRPM
qemu-kvm-1.5.3-167.el7.src.rpm	SHA-256: 4b6706861f653eb8ce97a2d45e43efce17d6348965578537174836197b9a963f
x86_64
qemu-img-1.5.3-167.el7.x86_64.rpm	SHA-256: f026a3637ee479e3084f6eefd28c51013d7a44ea9ce1ea0b7fc9c4789fef607e
qemu-kvm-1.5.3-167.el7.x86_64.rpm	SHA-256: 0d00a1bd18155d73fec860633b4aeb8b9e35cd8a5ac670e4857c3101408c98ff
qemu-kvm-common-1.5.3-167.el7.x86_64.rpm	SHA-256: 831c8b80be9606966963ab8764a202f942973f02a6e03ac546247474c7e26378
qemu-kvm-debuginfo-1.5.3-167.el7.x86_64.rpm	SHA-256: 4b21fa1557651bf9f74df772bbf7155d628f97df80a7cbfc3fb01c5f848f4bf4
qemu-kvm-tools-1.5.3-167.el7.x86_64.rpm	SHA-256: ab8273e090af3cd09cf9b74f9b48a9af800d35f84a7c91cc29ed87d61d77e038

Red Hat Enterprise Linux Workstation 7

SRPM
qemu-kvm-1.5.3-167.el7.src.rpm	SHA-256: 4b6706861f653eb8ce97a2d45e43efce17d6348965578537174836197b9a963f
x86_64
qemu-img-1.5.3-167.el7.x86_64.rpm	SHA-256: f026a3637ee479e3084f6eefd28c51013d7a44ea9ce1ea0b7fc9c4789fef607e
qemu-kvm-1.5.3-167.el7.x86_64.rpm	SHA-256: 0d00a1bd18155d73fec860633b4aeb8b9e35cd8a5ac670e4857c3101408c98ff
qemu-kvm-common-1.5.3-167.el7.x86_64.rpm	SHA-256: 831c8b80be9606966963ab8764a202f942973f02a6e03ac546247474c7e26378
qemu-kvm-debuginfo-1.5.3-167.el7.x86_64.rpm	SHA-256: 4b21fa1557651bf9f74df772bbf7155d628f97df80a7cbfc3fb01c5f848f4bf4
qemu-kvm-tools-1.5.3-167.el7.x86_64.rpm	SHA-256: ab8273e090af3cd09cf9b74f9b48a9af800d35f84a7c91cc29ed87d61d77e038

Red Hat Enterprise Linux Desktop 7

SRPM
qemu-kvm-1.5.3-167.el7.src.rpm	SHA-256: 4b6706861f653eb8ce97a2d45e43efce17d6348965578537174836197b9a963f
x86_64
qemu-img-1.5.3-167.el7.x86_64.rpm	SHA-256: f026a3637ee479e3084f6eefd28c51013d7a44ea9ce1ea0b7fc9c4789fef607e
qemu-kvm-1.5.3-167.el7.x86_64.rpm	SHA-256: 0d00a1bd18155d73fec860633b4aeb8b9e35cd8a5ac670e4857c3101408c98ff
qemu-kvm-common-1.5.3-167.el7.x86_64.rpm	SHA-256: 831c8b80be9606966963ab8764a202f942973f02a6e03ac546247474c7e26378
qemu-kvm-debuginfo-1.5.3-167.el7.x86_64.rpm	SHA-256: 4b21fa1557651bf9f74df772bbf7155d628f97df80a7cbfc3fb01c5f848f4bf4
qemu-kvm-tools-1.5.3-167.el7.x86_64.rpm	SHA-256: ab8273e090af3cd09cf9b74f9b48a9af800d35f84a7c91cc29ed87d61d77e038

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
qemu-kvm-1.5.3-167.el7.src.rpm	SHA-256: 4b6706861f653eb8ce97a2d45e43efce17d6348965578537174836197b9a963f
x86_64
qemu-img-1.5.3-167.el7.x86_64.rpm	SHA-256: f026a3637ee479e3084f6eefd28c51013d7a44ea9ce1ea0b7fc9c4789fef607e
qemu-kvm-1.5.3-167.el7.x86_64.rpm	SHA-256: 0d00a1bd18155d73fec860633b4aeb8b9e35cd8a5ac670e4857c3101408c98ff
qemu-kvm-common-1.5.3-167.el7.x86_64.rpm	SHA-256: 831c8b80be9606966963ab8764a202f942973f02a6e03ac546247474c7e26378
qemu-kvm-debuginfo-1.5.3-167.el7.x86_64.rpm	SHA-256: 4b21fa1557651bf9f74df772bbf7155d628f97df80a7cbfc3fb01c5f848f4bf4
qemu-kvm-tools-1.5.3-167.el7.x86_64.rpm	SHA-256: ab8273e090af3cd09cf9b74f9b48a9af800d35f84a7c91cc29ed87d61d77e038